📡Extensible Authentication Protocol

NEW

Also known as: EAP

An authentication framework that supports multiple methods and is widely used for network access control over 802.1X and RADIUS.

DESCRIPTION

EAP provides a flexible framework rather than a single method, enabling pluggable authentication mechanisms like EAP-TLS, PEAP, and EAP-TTLS. It underlies enterprise Wi‑Fi, VPN, and wired 802.1X access control. EAP separates transport from method, commonly carried over EAPOL or RADIUS. Strong deployments use certificate-based EAP-TLS, integrating with PKI and policy servers. Its extensibility supports evolving security requirements across devices and environments.

ALTERNATIVE DEFINITIONS

Wikipedia

Extensible Authentication Protocol (EAP) is an authentication framework frequently used in wireless networks and point-to-point connections.

Highlights use in wireless and point-to-point scenarios.

Source

IETF

This document defines the Extensible Authentication Protocol (EAP), an authentication framework which supports multiple authentication methods.

Emphasizes framework nature and method extensibility.

Source

RELATED TERMS

Remote Authentication Dial-In User Service IEEE 802.1X EAP-TLS EAP-TTLS PEAP TLS Public Key Infrastructure Supplicant Authenticator Authentication Server

COMPETING TERMS

Password Authentication Protocol Challenge-Handshake Authentication Protocol

RELATIONS

• Broader: Protocol

KNOWLEDGE AREAS

Data Security Infrastructure Software Engineering

TARGET AUDIENCE

Cybersecurity Engineer Security Architect Cloud Architect DevOps Engineer

EXTERNAL SOURCES

• Wikipedia - Extensible Authentication Protocol
• IETF - Core EAP specification.
• IETF - EAP-TLS method specification.
• FreeRADIUS - Open-source RADIUS server implementing EAP.

TOP QUESTIONS

Why choose Extensible Authentication Protocol for enterprise Wi‑Fi?

EAP enables strong methods like EAP-TLS with certificates, providing mutual authentication and resilience against credential theft.

Category: Relevancy

How does EAP relate to 802.1X?

802.1X defines port-based access control that transports EAP between supplicants and authenticators, typically proxied to RADIUS servers.

Category: Concept

What are common EAP methods?

EAP-TLS, PEAP (with MSCHAPv2), and EAP-TTLS are widely used; EAP-TLS is considered the strongest due to certificate-based mutual authentication.

Category: Example

What is a common mistake when deploying EAP?

Relying on weak inner methods like MS-CHAPv2 or not validating server certificates exposes users to credential theft.

Category: Mistakes

How does EAP support device onboarding?

Integration with PKI and MDM/EMM lets devices enroll certificates and authenticate via EAP-TLS seamlessly.

Category: Requirements

What risks exist with EAP misconfiguration?

Improper certificate validation, weak ciphers, or failing to constrain EAP methods can enable man-in-the-middle and credential attacks.

Category: Risks

How is EAP transported to the authentication server?

Authenticators encapsulate EAP in RADIUS or Diameter to communicate with the AAA server.

Category: Concept

What is a hot topic in EAP today?

Large-scale EAP-TLS with short-lived certs, device identity, and cloud RADIUS services are gaining adoption.

Category: Topic

How does EAP compare to PAP/CHAP?

EAP is a flexible framework supporting strong methods; PAP/CHAP are fixed, weaker protocols with limited security.

Category: Comparison