Which EAP methods do you know, and which would you pick for corporate laptops?
Show the answer
Say this first
EAP-TLS uses certificates on both sides, so it is mutual and there is no password to steal or phish: that is my pick for managed laptops. PEAP, usually with MSCHAPv2 inside, and EAP-TTLS build a TLS tunnel using only a server certificate and then send a password inside it. EAP-FAST is Cisco's tunnel method based on a protected access credential. TEAP is the newer standard tunnel method that can chain machine and user authentication. EAP-MD5 has no mutual authentication and no keys, so it should not be used.
Go deeper
Comparison
| Method | Client proves itself with | Server certificate | Notes |
|---|---|---|---|
| EAP-TLS | certificate | yes | strongest; needs PKI and enrollment |
| PEAP (MSCHAPv2) | password inside the tunnel | yes | easy; safe only if clients validate the server |
| EAP-TTLS | password or other inner method | yes | common on non-Windows clients |
| EAP-FAST | PAC, then inner method | optional | Cisco; supports chaining machine and user |
| TEAP | inner method, can chain several | yes | RFC 7170 |
| EAP-MD5 | password hash | no | no mutual auth, no keys, no wireless |
The PEAP risk in one sentence
If the supplicant does not validate the server certificate and name, an attacker's fake access point or port can terminate the tunnel and collect MSCHAPv2 exchanges, which can be cracked offline. Push the trusted CA and the expected server name to clients by policy.
What EAP-TLS needs in practice
An internal CA, automatic enrollment (AD Certificate Services autoenrollment, or SCEP from MDM), revocation checking on the RADIUS server, and monitoring of certificate expiry. Windows Credential Guard also blocks single sign-on with MSCHAPv2-based methods, another push toward certificates.
They will ask next
What is the difference between machine and user authentication?
Machine authentication uses the computer's credentials at boot, so the device is on the network for domain login, group policy and management before anyone signs in. User authentication runs after login. Chaining (EAP-FAST or TEAP) lets the server require both in one session.
Why is the outer identity often anonymous?
In tunneled methods the outer identity is sent before the tunnel exists, so it is visible to anyone on the path. The real username travels inside the tunnel.
Traps
- Saying EAP-TLS uses a username and password.
- Recommending PEAP without mentioning server certificate validation on the client.