Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does the authentication mechanism of 802.1X assume that you have already initially connected to the trusted network? What's puzzling me is that if I set up a cloned access point to fool users into connecting through me, if they connected to me before they connected to the proper network, how would they ever realise I wasnt the proper network? My dodgey access point can use 802.1X and I can give them my authentication messages and they can use my public key to decrypt? It doesnt tell them they are on the wrong network?

I presume 802.1X is only good at preventing this type of attack if you already have the public key of the trusted network on your machine? But now im confused again: how does my computer know which public key to use when I connect to a network? It cannot store the public keys according to SSIDs, because SSIDs are not unique??

share|improve this question
What is your question exactly? It is unclear from what you've written. – user3463 Jan 21 '12 at 21:41
See above for edit – Brad Jan 21 '12 at 21:54
Your computer doesn't need to know which public key to use. It simply connects to the network and then checks to see if the public key used is one it trusts. If so, it authenticates with the associated credentials, knowing it's talking to the right network. – David Schwartz Jan 21 '12 at 22:25
@David, as I understand it 802.1X provides mutual authentication using public key cryptography. If the server provides the public key then that defeats the point of the key being public, surely i should be obtaining it not from the server but from somewhere.... public so that I know it IS their public key? I dont understand how this is done on 802.1X for wireless? – Brad Jan 21 '12 at 22:40
@Brad I think you don't understand how public keys work fundamentally. You store a public key bound to an identity. The server proves it owns that public key, and then you prove you own that identity. Done. So the server says, "This is my public key, and here is proof it's mine." The client says, "Ahh, I have an identity for the owner of that key, here it is and here's proof it's mine." The server says, "Yes, that's you." – David Schwartz Jan 21 '12 at 22:48

[H]ow does my computer know which public key to use when I connect to a network? It cannot store the public keys according to SSIDs, because SSIDs are not unique?

The client has a set of credentials that is uses on various networks. Each credential is associated with a public key, owned by that corresponding network. The authentication proceeds as follows:

1) Client connects to network.

2) Network authenticates to client using the private key that corresponds to its public key.

3) Client now knows the network owns a particular public key. The client checks to see if it has an identity that corresponds to that public key.

4) Client proves its identity to the server with the identity the client associated with the network's public key.

The client doesn't need to know ahead of time what network it's connecting to.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .