1.4.2 EAP-TTLS

In the EAP-TLS, a TLS handshake is used to mutually authenticate a client and server, whereas, with EAP-TTLS (RFC 5281), the TLS handshake authenticates the server and not the client. The client is authenticated by another method, which takes place inside the secure tunnel established by the TLS handshake. There are two phases in EAP-TTLS, the TLS handshake phase (Phase 1) and the TLS tunnel phase (Phase 2).

  • In the handshake phase, the server is authenticated to the client using the standard TLS procedure, and keying material is generated to create a cryptographically secure tunnel for information exchange in the subsequent data phase.
  • In the tunnel phase, the TLS record layer is used to securely tunnel information between the client and the TTLS server. In this phase, the client is authenticated to the server using an arbitrary authentication mechanism encapsulated within the secure tunnel.
  • The encapsulated authentication mechanism may itself be EAP or it may be another authentication protocol such as PAP, CHAP, MS-CHAP or MSCHAP-V2 (ATWINC supports only MSCHAP-V2).
Figure 1-5. EAP-TTLS Protocol Method