User`s guide

D-5

Authentication

Direction

Mutual: Uses digital

certificates both

ways

Mutual: Certificate

for server

authentication, and

tunneled method for

client

Mutual: Certificate

for server, and

protected EAP

method for client

Protection of User

Identity Exchange

No Yes; protected by TLS Yes; protected by TLS

TLS is secure, but the requirement for client certificates is too big a hurdle for most institutions to

deal with.

TTLS, at least initially, is much more widely implemented than PEAP, and therefore has a slight

convenience advantage over the comparable PEAP method.

PEAP uses the TLS channel to protect a second EAP exchange. PEAP is backed by Microsoft.

Table D-1. Detailed Comparison of TLS-based EAP Methods (continued)

EAP Type

TLS

(RFC 2716)

TTLS

(Internet draft)

PEAP

(Internet draft)