Hello and welcome to this video called the EAP framework.
Now you might be wondering what is EAP?
Has that like a sound a little frightened mouse makes?
Is it's running away from the cheese?
No, that's not what we're talking about with EAP.
So EAP stands for the extensible authentication protocol.
Now EAP was not created expressly for wireless networks.
EAP is actually sort of the idea behind EAP was that this is another framework.
So remember when we're talking about frameworks, we're talking about sort
of like a blueprint or scaffolding for how to make, how to meet a general
objective. And the general objective of the EAP framework was how do we
create like a blueprint of how people can securely authenticate people
and devices connecting to networks.
That's sort of the general framework.
And there's a variety of ways that we can do that.
Now when you think about authenticating something, there's a variety of
ways you can do that, right?
Something could be authenticated purely based on the MAC address it has.
A person could be authenticated based on their credentials like their
username or password.
Maybe somebody could use some sort of facial recognition or a digital
certificate to do some authentication.
There's all sorts of ways.
So the reason why EAP is called the extensible authentication protocol
is because when EAP was first developed, it said, well, we're going to
find things like, you know, how are the authentication messages passed
back and forth between the person or devices authenticating and who they're
authenticating against.
What's the structure of that going to look like?
You know, what's the role of each device and the network going to be that
plays part in this?
They also said, let's develop these things called EAP methods.
And each EAP method defines how exactly is something going to authenticate
itself. For example, an EAP method might say, hey, just provide your username
and password. And then if you provide it correctly, you're good.
Another EAP method might be, well, we need to exchange digital certificates
in order to provide authentication.
So EAP methods, each EAP method specifically defines the mechanisms to
authenticate between the end user and whoever they're authenticating against.
And the reason why they called extensible is because EAP was developed
in such a way that it wasn't really rigid so that in the future, people
could come up with other additional EAP methods.
So if you want to come up with your own EAP method, go for it.
You could do that.
Okay, so within the framework of EAP, the framework says, well, we can
have three different roles participating this whole authentication thing.
So the EAP framework defined the three roles of supplicant, authenticator
and authentication server.
So supplicant is the end device, like your laptop, your tablet, your smartphone,
the thing that's trying to gain access to the network.
That's called the supplicant.
The authenticator is the device that says, hold on a second.
Before I give you network access, you have to prove yourself to me.
So in the context of wireless, the authenticator would be your access
point. That would be the authenticator.
EAP can also be used in wired networks.
So the authenticator might be the network switch that you're connecting
to. If you're connecting directly to a router, the router could be the
supplicant. And then the third device, or the third role is who is actually
storing those network credentials and validating what the supplicant is
providing and maybe challenging the supplicant by saying, well, thank
you for that. But I need a little bit more.
I need a little bit more information from you.
And this is what I'm looking for that device, which a lot of times is
a back end server is called an authentication server.
So when EAP is involved, the layer two frame, whether it be a Wi-Fi frame
is defined by an 802.11 frame type or a wired frame like a regular Ethernet
frame. The type value like the ether type will be specific to zero X,
eight, eight, eight, eight.
So if you ever see a wireless frame or a wired Ethernet frame and the
ether type or the type values of zero X, eight, eight, eight, that means
that is carrying EAP in the payload of that frame.
And there's authentication taking place right then and there.
Okay, so within the ether type value of zero X, eight, eight, eight, eight,
eight, which is sort of generic for EAP over land.
EAP OL, that's EAP over land, the extensible authentication protocol over
land. There are different types of EAP packets, depending on what your
cop trying to do.
For example, a supplicant, like your smartphone, your tablet, the very
first one they might send might be an EAP over land start message, meaning,
okay, I would like to start the whole process of doing authentication.
The, there might be what's called EAP over land packet frames, which has
the methods inside them like here's my username and password.
Here's my digital certificate.
Maybe the authentication server saying, I need more from you.
Give me some additional data.
That would also be contained within an EAP over land packet frame.
And there's also EAP over land key frames and there's others as well.
But all of those are carried at layer two with a frame type of zero X,
eight, eight, eight, eight.
Now, in Wi-Fi. The robust security network.
Said we're going to use this thing called EAP that somebody's already
developed. We like it.
It works for us.
Let's go ahead and use it.
And so in the world of Wi-Fi.
So, um, the, eight, oh, two, eleven, I Wi-Fi, they said, well, first of
all, we're going to divide.
So, you're going to have your application in the right.
And we say this uses 802 .1 X to do all of this.
Now, 802.1 X is another protocol, but 802.1 X also uses EAP.
So if you're looking at the, you're going to have your authentication
server on the right.
So, we're going to use it as a way of using EAP to do our authentication
methods. All right.
So it all comes back to the extensible authentication protocol.
Now in WPA enterprise, you've got these three device roles and everything
that EAP does from the EAP over land start message to the EAP over land
packet exchanges to the EAP over land key messages, all takes place.
But we also know that in Wi-Fi, we have WPA personal, right?
In WPA to personal, which means you're not using the backend server.
All you've got is the access point and the client.
So in that case, the client and the access point already know, already
has some shared set of authentication credentials, usually just like a
pre shared key, like the key for this wireless land is coffee 123 or I
and E 5567, something like that.
So when we start out at the very beginning with the assumption that the
client and the access point already have some shared credentials and the
goal is, let's just make sure that's true.
Let's make sure that you and I have the exact same set of credentials.
If that's true, you're in and we can move on and we can be done with authentication.
That's WPA personal.
And that particular case, the EAP over land start message, you won't see
that. And the EAP over land packet exchanges, you won't see that as well.
That's why the slide says the EAP over land start and EAP over land packet
is only required for WPA enterprise.
But what you will see are the EAP over land key messages and there's always
four of them. A lot of times this is called the EAP over land four way
handshake because there's four messages that go back and forth.
So the main take away from this is that whether you're doing WPA enterprise
or WPA personal, you will always see the EAP over land four way handshake
the EAP over land key frames.
This other stuff, you will only see if you're doing a full 802.1x implementation
of WPA enterprise.
Now let's talk just a little bit more about that four way handshake.
So the 802.11i standard mandates that you have to use that four way handshake
after notice this after the pairwise master key has been established.
Now, I'm not sure where you're watching this videos or in the scheme of
the course of which it was created.
Maybe you're watching it just by itself.
So maybe you don't know what a pairwise master key is.
That's fine. I will just say without going too far down the road that
with Wi-Fi, a variety of keys have to be derived and it typically goes
in a particular order where one key is derived first and then other keys
are derived from that key using a variety of algorithms and formulas and
things. So the first key that is typically developed is this PMK the pairwise
master key. So what this is saying here is that according to the 802.11i,
there's a couple of different ways.
The pairwise master key can be derived.
And I'll talk about that in subsequent videos.
But the point is once that pairwise master key has been derived, then
we do the four way Epos.
So that Epos. Is used for a variety of reasons.
Number one to confirm that you access point and me client both have the
same shared pairwise master key.
Remember, that's for us.
It's a pair of people that's you and me access point client.
That's a single pair.
You and I are going to have a pairwise master key that's different than
you and Sally or you and Bob.
So we have to confirm that the PMK that I have and you have is the same.
That's going to be part of the purpose of the four way Epos over land
handshake. And then we're going to derive other keys.
One of which will eventually be used to actually encrypt the data.
So eventually we're going to get to the point after the four way handshake
is done. Where I'm going to start sending you like HTTP frames for I and
E's website or telnet frames.
I'm trying to tell that into a server over there or something like that.
And all of that is going to have to be encrypted.
So we're going to derive a particular key to do that.
And the four way handshake is going to help us to derive that key.
And also to transmit broadcast and multicast encryption keys from the
access point to the client.
So it's the Epos over land key frames that are used in this process.
So we just saw that just a moment ago.
And I'll show you that one more time.
So once again, just serve as a recap here.
Epos over land packet frames may or may not be there just depending on
whether you're doing WPA enterprise or not.
If you're not doing WPA enterprise, if you're doing WPA personal, you're
not going to see these.
Either way, once the Epos over land, if whether you got Epos, if you,
if you're doing Epos over land packet frames, then the end result of that
is that a key called the master session key will be derived.
So it's actually in WPA enterprise that requires an authentication server.
It's actually the authentication server that creates this.
So the authentication server will say, you're good.
You've proven yourself to me.
I have a, I'm officially authenticating you.
And as a result, I'm going to give you a gift.
I'm going to give you a master session key.
So that will be derived.
And then in WPA enterprise, the master session key is then used to derive
the pairwise master key.
So this is actually mathematically derived from this.
And you'll see when we get into that, that it's actually pretty simple
how that works. Now, in WPA personal, we skip the Epos over land packet
frames. We don't have a master session key.
And instead, we just use that pre shared key like coffee, one, two, three,
or best Wi-Fi ever, whatever the pre shared key is for the wireless land.
And we use that as a component of a formula to come up with the pairwise
master key. So you always have a pairwise master key.
The only question is where did it come from?
Did it come from the master session key or was it derived from the passphrase,
the pre shared key?
Either way, you've got the pairwise master key.
Now, once you've got this, then the four way handshake has to happen.
The Epos over land key frames have to be exchanged.
And that's what's used to derive these other keys down here.
And if you're doing a wireless sniffer capture, unlike wire shark or something,
this is what you'll see.
So this, for example, is a sniffer trace taken from a WPA personal association
because notice we don't see any Epos over land packet frames here.
We go directly from authentication to association.
And then we have the four way Epos over land handshake.
And notice how it says key.
So these are Epos over land key messages.
And there's four of the message one, two, three and four.
And subsequent videos will talk about specifically what information is
carried in each one of these messages.
But that concludes this introduction to the Epos over land framework.
Thank you so much for watching.
And I really hope it was helpful for you.