802.1x EAP-TLS vs PEAP-EAP-TLS

[craig.cartlidge1]

Can anyone please explain the advantage (if any!) of using PEAP-EAP-TLS as opposed to just EAP-TLS for wired 802.1x deployments.

We are deploying wired 802.1x machine based authentication and have a PKI infrastructure, I was under the impression that we just need to use EAP-TLS since we have a working PKI deployment and all machines have a certificate.

The server guys seem to think we need to use PEAP with EAP-TLS, but cant really explain to me why, this just seems like extra work, is there any advantage ? I can understand using PEAP for things like MS-CHAP authentication, but since we are using EAP-TLS anyway this seems pointless.

Thanks

[Francesco Molino]

Hi

Eap-tls is based on client certificate authentication while peap-eap-tls is based on server side certificate authentication. 

With peap-eap-tls, the 1st phase will be the encrypted tunnel with server side authentication and then all user sensitive information are encrypted. With this method, no user certificate will be required. It's peap v1.

With eap-tls, you will need a user certificate to authenticate. 

I attach an image that show you differences. Take  a look at column 2 and 4.

Thanks 

PS: Please don't forget to rate and mark as correct answer if this solved your issue 

[alburger]

This is incorrect. PEAP-EAP-TLS encrypts the EAP-TLS certificate transfer with a PEAP Tunnel. Certificates are still required on both the client and server. There is just added security of a TLS tunnel prior to certificate exchange. PEAP-EAP-MSCHAPv2 only requires a server side certificate while the rest of the authentication is performed as user/pass. 

[Francesco Molino]

Yes your right and I'm sorry. I'm thinking why i answered this when the question was peap-eap-tls. 

Maybe i thought (I red to quickly) it was asked eap-ttls on which client authentication isn't required. 

Thanks for having corrected the answer. 

[alburger]

Not a problem!