Feeds

Confirmed: MS to ship beefed up 802.11 security in XP SP1

Surely not a reason to upgrade from Win2k? You amaze us...

  • alert
  • submit to reddit

Gartner critical capabilities for enterprise endpoint backup

Microsoft will, as suggested here last week, be shipping a Protected Extensible Authentication Protocol (PEAP) client with SP1 of Windows XP. This will beef up wireless security in XP and will no doubt come in handy for the mysterious security of Microsoft's forthcoming home wireless products.

Thanks to readers for the snap of XP SP1's wireless properties, showing Protected EAP security enabled, and for a couple of useful links. Microsoft Technet's Cable Guy discusses PEAP in the July column, and over at Sifry's Alerts there are a few pertinent comments.

Dave Sifry suggests that, because the Access Points (APs) will need to be able to handle multiple TLS sessions, they'll need to be more powerful than the current generation that's on sale.

Sifry also says that "each access point must now have a TLS certificate, which is fine if you're VeriSign or if you're shelling out the dough for Microsoft's CA implementation across your organization." This would certainly be the case if you were running a local wireless network that did not use an authentication server (and would indeed chew up a lot of horsepower), but Technet's Cable Guy describes a scenario which uses PEAP and MS-CHAP V2 with an authentication server, simply using the AP as a pass through device. This is what he has to say about certificates:

"PEAP with MS-CHAP v2 requires certificates on the IAS servers but not on the wireless clients. IAS servers must have a certificate installed in their Local Computer certificate store. Instead of deploying a PKI, you can purchase individual certificates from a third-party CA to install on your IAS servers. To ensure that wireless clients can validate the IAS server certificate chain, the root CA certificate of the CA that issued the IAS server certificates must be installed on each wireless client.

"Windows XP includes the root CA certificates of many third-party CAs. If you purchase your IAS server certificates from a third-party CA that corresponds to an included root CA certificate, no additional wireless client configuration is required. If you purchase your IAS server certificates from a third party CA for which Windows XP does not include a corresponding root CA certificate, you must install the root CA certificate on each wireless client."

Clearly, for home networking, there's a piece of the picture still missing. It's possible that Microsoft could offer some form of external authentication services (hardly uncharacteristic of Redmond, this), but this would be a little bit of an own-goal if it resulted in home and small office networks that were paralysed if the internet connection was down. So not an option on its own. Alternatively, or additionally, APs could have their own certificates built in, and if you viewed the implimentation as being optional, i.e. AP authentication for small office, home gateway type systems, and server authentication for business, then the crunching requirements for the AP/gateway probably wouldn't be that great.

Presuming Microsoft does have that missing piece of the picture and does intend to deploy PEAP in its home wireless networks, then we can rough out a few of those edges it likes to give itself. A system that is reasonably secure out of the box would be pretty attractive for home users, for those of them who've actually heard of security, anyway. It would also be a fairly significant reason for installing SP1. And for Windows 2000 users? Well yes, no doubt MS-PEAP for Win2k will ship in the fullness of time, but we'd guess Win9x users can forget it.

Depending on how Microsoft does the implementation and how hard it decides to push PEAP, non-MS operating systems could be speed-bumped. PEAP is currently an IETF standard in progress, so theoretically non-MS operating systems won't be disadvantaged in the long run, but early implementation and popularisation of a standard by Microsoft, leaving the rest of the world eating dust and puzzling over APIs, is something we've seen before too. Not that we're saying this is necessarily bad, of course. It's just frequently difficult to disentangle the trail-blazing (Microsoft's view) aspects of Redmond's roadmaps from the edge-getting (everybody else's) ones. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Why has the web gone to hell? Market chaos and HUMAN NATURE
Tim Berners-Lee isn't happy, but we should be
Mozilla's 'Tiles' ads debut in new Firefox nightlies
You can try turning them off and on again
Microsoft boots 1,500 dodgy apps from the Windows Store
DEVELOPERS! DEVELOPERS! DEVELOPERS! Naughty, misleading developers!
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Apple promises to lift Curse of the Drained iPhone 5 Battery
Have you tried turning it off and...? Never mind, here's a replacement
Uber, Lyft and cutting corners: The true face of the Sharing Economy
Casual labour and tired ideas = not really web-tastic
Linux turns 23 and Linus Torvalds celebrates as only he can
No, not with swearing, but by controlling the release cycle
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.