Feeds

Confirmed: MS to ship beefed up 802.11 security in XP SP1

Surely not a reason to upgrade from Win2k? You amaze us...

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Microsoft will, as suggested here last week, be shipping a Protected Extensible Authentication Protocol (PEAP) client with SP1 of Windows XP. This will beef up wireless security in XP and will no doubt come in handy for the mysterious security of Microsoft's forthcoming home wireless products.

Thanks to readers for the snap of XP SP1's wireless properties, showing Protected EAP security enabled, and for a couple of useful links. Microsoft Technet's Cable Guy discusses PEAP in the July column, and over at Sifry's Alerts there are a few pertinent comments.

Dave Sifry suggests that, because the Access Points (APs) will need to be able to handle multiple TLS sessions, they'll need to be more powerful than the current generation that's on sale.

Sifry also says that "each access point must now have a TLS certificate, which is fine if you're VeriSign or if you're shelling out the dough for Microsoft's CA implementation across your organization." This would certainly be the case if you were running a local wireless network that did not use an authentication server (and would indeed chew up a lot of horsepower), but Technet's Cable Guy describes a scenario which uses PEAP and MS-CHAP V2 with an authentication server, simply using the AP as a pass through device. This is what he has to say about certificates:

"PEAP with MS-CHAP v2 requires certificates on the IAS servers but not on the wireless clients. IAS servers must have a certificate installed in their Local Computer certificate store. Instead of deploying a PKI, you can purchase individual certificates from a third-party CA to install on your IAS servers. To ensure that wireless clients can validate the IAS server certificate chain, the root CA certificate of the CA that issued the IAS server certificates must be installed on each wireless client.

"Windows XP includes the root CA certificates of many third-party CAs. If you purchase your IAS server certificates from a third-party CA that corresponds to an included root CA certificate, no additional wireless client configuration is required. If you purchase your IAS server certificates from a third party CA for which Windows XP does not include a corresponding root CA certificate, you must install the root CA certificate on each wireless client."

Clearly, for home networking, there's a piece of the picture still missing. It's possible that Microsoft could offer some form of external authentication services (hardly uncharacteristic of Redmond, this), but this would be a little bit of an own-goal if it resulted in home and small office networks that were paralysed if the internet connection was down. So not an option on its own. Alternatively, or additionally, APs could have their own certificates built in, and if you viewed the implimentation as being optional, i.e. AP authentication for small office, home gateway type systems, and server authentication for business, then the crunching requirements for the AP/gateway probably wouldn't be that great.

Presuming Microsoft does have that missing piece of the picture and does intend to deploy PEAP in its home wireless networks, then we can rough out a few of those edges it likes to give itself. A system that is reasonably secure out of the box would be pretty attractive for home users, for those of them who've actually heard of security, anyway. It would also be a fairly significant reason for installing SP1. And for Windows 2000 users? Well yes, no doubt MS-PEAP for Win2k will ship in the fullness of time, but we'd guess Win9x users can forget it.

Depending on how Microsoft does the implementation and how hard it decides to push PEAP, non-MS operating systems could be speed-bumped. PEAP is currently an IETF standard in progress, so theoretically non-MS operating systems won't be disadvantaged in the long run, but early implementation and popularisation of a standard by Microsoft, leaving the rest of the world eating dust and puzzling over APIs, is something we've seen before too. Not that we're saying this is necessarily bad, of course. It's just frequently difficult to disentangle the trail-blazing (Microsoft's view) aspects of Redmond's roadmaps from the edge-getting (everybody else's) ones. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
FTDI yanks chip-bricking driver from Windows Update, vows to fight on
Next driver to battle fake chips with 'non-invasive' methods
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.