We're in the process of implementing PEAP (MS-ChapV2), authenticating to an existing NT Active Dir domain and all is working ok. Two questions...

1) I've got the key rotation set for every 5 minutes on the RADIUS server (Cisco Secure 3.2). Will TKIP get any additional security?

2) The period of time the PC is given to authenticate is too short. It's actually around 2 minutes which should be long enough but I'd like to lengthen it to an hour or so.

    Requires Free Membership to View

TKIP encryption is based on transient keys, changed often enough to prevent the key reuse that lead to WEP cracking. In TKIP, there are pairwise transient keys and group transient keys. Pairwise transient keys are different for every association. They get derived and installed at the end of 802.1X. They can be automatically updated as needed, using the pairwise master key, because changes affect only one association.

The same broadcast key must be used by all stations connected to an AP (or a VLAN on an AP). When using TKIP, the group transient key is delivered securely after the pairwise transient keys are derived and installed. Because the same group key is used by everyone, it is effectively static unless something forces it to change. Broadcast key rotation updates that group transient key for all stations currently associated to the AP.

I am not aware of a configurable timeout that would control how long a station is given to authenticate overall, but you can usually control how long the AP and RADIUS server wait before timing out on any individual RADIUS message. For example, see radius-server timeout in Cisco APs.

This was first published in October 2003

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: