Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering what the relative security of RADIUS is compared to using a PSK.

I know that when using Radius a unique session key is established, whereas with a PSK the same session key is used for everyone, so on that basis Radius seems more secure.

However, to authenticate against a Radius network you only need a Windows account's credentials - which could have a much weaker username/password combination than PSK - so an attacker trying to get in by brute-forcing could potentially get in quicker with Radius than a PSK (a 256-bit PSK is harder to derive than a 4 character username with an 8 character password).

Right now my wireless network only really has myself as a regular user and a couple of others who use it occasionally, and the network is configured using WPA2-Radius (against my home Active Directory) - it's only a residential network and I don't believe it's going to be a target, but you never know what the geeky kid living round the corner is plotting...

share|improve this question
If you are using radius, then typically your user-database will have account lockout systems in place that will disable the account for a largish period if time after a relatively small threshold of attempts. You get 7 tries every 2 hours at one location I am aware of. A brute-force where you try only ~200-300 possibilities per day isn't going to work out so well, plus you will most likely be leaving huge logs of your activities. – Zoredache Feb 10 '12 at 1:14
up vote 4 down vote accepted

RADIUS is the better option provided secure (ie long) passwords / passphrases are used and a sensible lock out policy is in place.

The main reason for this is that for RADIUS, you need to interact with an authentication service to test a password, and so once you are locked out, that is the end of your attempt to breach.

With PSK, all you need to do is capture enough handshakes that you can take offline and bruteforce it. In other words, the bruteforcing of a PSK is done without any interaction with the AP once the requisite handshakes are captured, and so are undetectable. You would be totally unaware of it. Combine this with the difficulty in changing a PSK and rolling out a new one.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .