Feeds

Confirmed: MS to ship beefed up 802.11 security in XP SP1

Surely not a reason to upgrade from Win2k? You amaze us...

  • alert
  • submit to reddit

The next step in data security

Microsoft will, as suggested here last week, be shipping a Protected Extensible Authentication Protocol (PEAP) client with SP1 of Windows XP. This will beef up wireless security in XP and will no doubt come in handy for the mysterious security of Microsoft's forthcoming home wireless products.

Thanks to readers for the snap of XP SP1's wireless properties, showing Protected EAP security enabled, and for a couple of useful links. Microsoft Technet's Cable Guy discusses PEAP in the July column, and over at Sifry's Alerts there are a few pertinent comments.

Dave Sifry suggests that, because the Access Points (APs) will need to be able to handle multiple TLS sessions, they'll need to be more powerful than the current generation that's on sale.

Sifry also says that "each access point must now have a TLS certificate, which is fine if you're VeriSign or if you're shelling out the dough for Microsoft's CA implementation across your organization." This would certainly be the case if you were running a local wireless network that did not use an authentication server (and would indeed chew up a lot of horsepower), but Technet's Cable Guy describes a scenario which uses PEAP and MS-CHAP V2 with an authentication server, simply using the AP as a pass through device. This is what he has to say about certificates:

"PEAP with MS-CHAP v2 requires certificates on the IAS servers but not on the wireless clients. IAS servers must have a certificate installed in their Local Computer certificate store. Instead of deploying a PKI, you can purchase individual certificates from a third-party CA to install on your IAS servers. To ensure that wireless clients can validate the IAS server certificate chain, the root CA certificate of the CA that issued the IAS server certificates must be installed on each wireless client.

"Windows XP includes the root CA certificates of many third-party CAs. If you purchase your IAS server certificates from a third-party CA that corresponds to an included root CA certificate, no additional wireless client configuration is required. If you purchase your IAS server certificates from a third party CA for which Windows XP does not include a corresponding root CA certificate, you must install the root CA certificate on each wireless client."

Clearly, for home networking, there's a piece of the picture still missing. It's possible that Microsoft could offer some form of external authentication services (hardly uncharacteristic of Redmond, this), but this would be a little bit of an own-goal if it resulted in home and small office networks that were paralysed if the internet connection was down. So not an option on its own. Alternatively, or additionally, APs could have their own certificates built in, and if you viewed the implimentation as being optional, i.e. AP authentication for small office, home gateway type systems, and server authentication for business, then the crunching requirements for the AP/gateway probably wouldn't be that great.

Presuming Microsoft does have that missing piece of the picture and does intend to deploy PEAP in its home wireless networks, then we can rough out a few of those edges it likes to give itself. A system that is reasonably secure out of the box would be pretty attractive for home users, for those of them who've actually heard of security, anyway. It would also be a fairly significant reason for installing SP1. And for Windows 2000 users? Well yes, no doubt MS-PEAP for Win2k will ship in the fullness of time, but we'd guess Win9x users can forget it.

Depending on how Microsoft does the implementation and how hard it decides to push PEAP, non-MS operating systems could be speed-bumped. PEAP is currently an IETF standard in progress, so theoretically non-MS operating systems won't be disadvantaged in the long run, but early implementation and popularisation of a standard by Microsoft, leaving the rest of the world eating dust and puzzling over APIs, is something we've seen before too. Not that we're saying this is necessarily bad, of course. It's just frequently difficult to disentangle the trail-blazing (Microsoft's view) aspects of Redmond's roadmaps from the edge-getting (everybody else's) ones. ®

Security for virtualized datacentres

More from The Register

next story
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Mathematica hits the Web
Wolfram embraces the cloud, promies private cloud cut of its number-cruncher
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Mozilla shutters Labs, tells nobody it's been dead for five months
Staffer's blog reveals all as projects languish on GitHub
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 Healthkit gets a bug SO Apple KILLS it. That's real healthcare!
Not fit for purpose on day of launch, says Cupertino
Profitless Twitter: We're looking to raise $1.5... yes, billion
We'll spend the dosh on transactions, biz stuff 'n' sh*t
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.