Feeds

MS to use PEAP for home wireless security?

It's tagged as a possible for a 'future XP client'

  • alert
  • submit to reddit

Build a business case: developing custom apps

A little bird suggests to The Register that Microsoft's "more secure than others" wireless products will be using Protected Extensible Authentication Protocol (PEAP). He further suggests that PEAP support will ship with Windows XP SP1, and although we hadn't heard that as a possible SP1 addition, Microsoft is a supporter of PEAP, and a while back said a "future version of the Windows client may also include Protected Extensible Authentication Protocol," here.

PEAP would certainly be one way to beef up wireless security for small business, homes, and execs wireless hot-spotting out of range of the corporate network cops. According to Microsoft's paper (which incidentally contains several suggestions regarding the security content of "future" versions of the Windows client) PEAP "provides a mechanism for mutual authentication and session key generation in a roaming environment." It allows a client to establish an encrypted session with an access point and then with a server by setting up a TLS session, EAP being wrapped inside TLS.

One advantage of this is that it allows the use of username/password challenge/response authentication rather than relying on certificate exchange. According to the IETF working draft, the protection of EAP within a TLS channel also gets round the deficiency of EAP whereby negotiation is unprotected, and hence vulnerable to attack.

So will it be part of Microsoft's wireless security? Could be, and considering there aren't supposed to be many future versions of the Windows client (apart from Tablet PC edition, that is) for quite some while, shipping it in SP1 if possible, or as an add-on if not, makes sense. In any event, in order to be useful it would have to be available around the time of SP1, because shortly afterwards Microsoft will be needing it, or an alternative, for both home wireless and Tablet PCs. ®

Related story:
MS talks to self about not talking about home 802.11b range

Secure remote control for conventional and virtual desktops

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Why has the web gone to hell? Market chaos and HUMAN NATURE
Tim Berners-Lee isn't happy, but we should be
Microsoft boots 1,500 dodgy apps from the Windows Store
DEVELOPERS! DEVELOPERS! DEVELOPERS! Naughty, misleading developers!
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Mozilla's 'Tiles' ads debut in new Firefox nightlies
You can try turning them off and on again
Linux turns 23 and Linus Torvalds celebrates as only he can
No, not with swearing, but by controlling the release cycle
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
This is how I set about making a fortune with my own startup
Would you leave your well-paid job to chase your dream?
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.