Re: support for multiple EAP methods in one config?

Hi Michael,

On 1/9/25 7:37 AM, Michael John wrote:
> Hello,
> 

Please get rid of the confidentiality footer.  It doesn't make any sense when 
you're corresponding on a public mailing list.

> I'm looking to see if IWD supports the ability to support multiple EAP method, like what can be done in wpa_supplicant.
> 
> network={
>      ssid="example"
>      key_mgmt=WPA-EAP
>      eap=TTLS PEAP
>      identity="username"
>      password="password"
>      # Try basically every common inner method
>      phase2="autheap=MSCHAPV2 autheap=MD5 autheap=GTC autheap=OTP autheap=TLS auth=MSCHAPV2 auth=MSCHAP auth=PAP auth=CHAP auth=GTC"
> }
> 

No, and it probably doesn't even work with wpa_supplicant.  Not in a way you 
expect anyway.  See https://w1.fi/cgit/hostap/tree/src/eap_peer/eap_ttls.c#n112.

The fundamental problem is that some methods, like EAP-TTLS, expect the client 
to start the inner authentication, and there's no good retry mechanism in case 
the tried inner method fails.  With PEAP this is less of a problem, but then 
PEAP is pretty much only deployed with MSCHAPv2 as the inner method.

> My use case is that I'm given a username and password for a network but don't know the outer or inner protocols (or even if its personal or enterprise but I can determine that from the broadcast beacon).

If you have a username, then that precludes PSK networks as those don't have 
such a concept?

However, username/password is really not enough.  PEAP/TTLS based authentication 
really requires a CA certificate to be set.  Otherwise anyone can spoof your 
Enterprise network with $50 router.  If public CAs are used, then a 
ServerDomainMatch setting is also advised.

iwd doesn't support a 'Trust on First Use' style scenario where the signature / 
certificate reported by the peer AP would be presented to the user for 
verification on the initial connection.  We didn't think supporting such a use 
case was good a good security practice.

For enterprise networks I strongly advise figuring out some sort of provisioning 
mechanism.  There's even some code in iwd to convert iOS provisioning format to 
iwd settings files.  See tools/ios_convert.py

Regards,
-Denis