User vs Computer Authentication

[hs08]

From security perspective which one is more secure between 802.1x using user authentication or computer authentication?

[Rob Ingram]

@hs08 the most secure authentication method would be EAP Chaining, which combines both user and computer authentication using TEAP or EAP-FAST and using EAP-TLS (certificates) as the inner method for authentication.

Independently, then I would say computer authentication is more secure than user authentication.

[hs08]

Hi @Rob Ingram can you describe why computer auth is more secure?

[aleabrahao]

@hs08 EAP-TLS is more secure because the user can only authenticate if the certificate is installed on the machine; essentially, you need that trust relationship to authenticate on the network.

[hs08]

Hi @aleabrahao , @Rob Ingram  Yes i mean different eap-tls with user or computer authentication i mean

[Rob Ingram]

@hs08 if using EAP-TLS computer authentication on a windows laptop a normal (non administrator) user does not have to the computer certificate store to potentially export the computer certificate and reuse on another device. The user could however potentially access the user certificate store and export the certificate to reuse on another device.

[Rob Ingram]

@hs08 if using user authentication a user could just manually enter their username/password (PEAP/MSCHAPv2) and connect using wired or wireless on an untrusted device (a personal laptop). You cannot get access to the computer password to manually connect.

This is why using EAP Chaining (TEAP/EAP-FAST) combines both user and computer authentication using EAP-TLS, which is considered more secure.

[Ambuj M]

at cipher level there is no difference both are equally secure and both may be subject to same vulnerability.

Generally speaking if you want to just authenticate devices before they can access network, you can live with computer authentication only. However if you want to use "authentication" and role based "authorization" then user authentication is required. more over you may have several situation where you can have shared machines that use single computer cert but multiple user cert.

If you are planning a deployment in production use both or combination of both like TEAP or EAP Chaining

[Marvin Rhoads]

I agree with what most of the other respondents have noted. I would add that the Authorization results can be fine-tuned better when authenticating both user and computer (preferably with TEAP and EAP-TLS inner method). You then have one type of Authorization result for computer-only (perhaps only allowing access to systems necessary for group policy updates) and a broader scope of access when both the User and Computer are authenticated.