Feeds

Confirmed: MS to ship beefed up 802.11 security in XP SP1

Surely not a reason to upgrade from Win2k? You amaze us...

  • alert
  • submit to reddit

Providing a secure and efficient Helpdesk

Microsoft will, as suggested here last week, be shipping a Protected Extensible Authentication Protocol (PEAP) client with SP1 of Windows XP. This will beef up wireless security in XP and will no doubt come in handy for the mysterious security of Microsoft's forthcoming home wireless products.

Thanks to readers for the snap of XP SP1's wireless properties, showing Protected EAP security enabled, and for a couple of useful links. Microsoft Technet's Cable Guy discusses PEAP in the July column, and over at Sifry's Alerts there are a few pertinent comments.

Dave Sifry suggests that, because the Access Points (APs) will need to be able to handle multiple TLS sessions, they'll need to be more powerful than the current generation that's on sale.

Sifry also says that "each access point must now have a TLS certificate, which is fine if you're VeriSign or if you're shelling out the dough for Microsoft's CA implementation across your organization." This would certainly be the case if you were running a local wireless network that did not use an authentication server (and would indeed chew up a lot of horsepower), but Technet's Cable Guy describes a scenario which uses PEAP and MS-CHAP V2 with an authentication server, simply using the AP as a pass through device. This is what he has to say about certificates:

"PEAP with MS-CHAP v2 requires certificates on the IAS servers but not on the wireless clients. IAS servers must have a certificate installed in their Local Computer certificate store. Instead of deploying a PKI, you can purchase individual certificates from a third-party CA to install on your IAS servers. To ensure that wireless clients can validate the IAS server certificate chain, the root CA certificate of the CA that issued the IAS server certificates must be installed on each wireless client.

"Windows XP includes the root CA certificates of many third-party CAs. If you purchase your IAS server certificates from a third-party CA that corresponds to an included root CA certificate, no additional wireless client configuration is required. If you purchase your IAS server certificates from a third party CA for which Windows XP does not include a corresponding root CA certificate, you must install the root CA certificate on each wireless client."

Clearly, for home networking, there's a piece of the picture still missing. It's possible that Microsoft could offer some form of external authentication services (hardly uncharacteristic of Redmond, this), but this would be a little bit of an own-goal if it resulted in home and small office networks that were paralysed if the internet connection was down. So not an option on its own. Alternatively, or additionally, APs could have their own certificates built in, and if you viewed the implimentation as being optional, i.e. AP authentication for small office, home gateway type systems, and server authentication for business, then the crunching requirements for the AP/gateway probably wouldn't be that great.

Presuming Microsoft does have that missing piece of the picture and does intend to deploy PEAP in its home wireless networks, then we can rough out a few of those edges it likes to give itself. A system that is reasonably secure out of the box would be pretty attractive for home users, for those of them who've actually heard of security, anyway. It would also be a fairly significant reason for installing SP1. And for Windows 2000 users? Well yes, no doubt MS-PEAP for Win2k will ship in the fullness of time, but we'd guess Win9x users can forget it.

Depending on how Microsoft does the implementation and how hard it decides to push PEAP, non-MS operating systems could be speed-bumped. PEAP is currently an IETF standard in progress, so theoretically non-MS operating systems won't be disadvantaged in the long run, but early implementation and popularisation of a standard by Microsoft, leaving the rest of the world eating dust and puzzling over APIs, is something we've seen before too. Not that we're saying this is necessarily bad, of course. It's just frequently difficult to disentangle the trail-blazing (Microsoft's view) aspects of Redmond's roadmaps from the edge-getting (everybody else's) ones. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Microsoft WINDOWS 10: Seven ATE Nine. Or Eight did really
Windows NEIN skipped, tech preview due out on Wednesday
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.