Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The question really says it all. Is it possible to have a secure connection from a WiFi-server to a WiFi-client through any common protocol, that doesn't require the server and the client to share a secret?

If so, how can that work?? :-)

share|improve this question
How can you set up encryption without a shared secret? SSL kinda works that way, do you mean never share a secret, or don't share a secret initially? – NickW Jun 7 '13 at 13:38
Never share a secret. Imagine setting up a WiFi-Network which is not password protected. Is there a way to make that network tap-proof anyway? – Lea Hammerschmidt Jun 7 '13 at 13:39
I believe that once you're on the wifi network, you can see all the traffic that's in radio range of you. I think you need connection-level security (SSL, SSH, TLS) or encapsulation (a VPN). – pjc50 Jun 7 '13 at 14:01

It's not as daft a question as it may first appear:

  • An access point is configured to back off authentication to a RADIUS server.
  • The RADIUS server has its own certificate authority which issues certificates to clients. Certificates, once issued, can be revoked.
  • When a client connects, it presents its certificate via the access point to the RADIUS server, which decides whether authentication should succeed. The certificate must be signed by the server, and must not appear on its certificate revocation list.
  • If the client is successfully authenticated, the RADIUS server sends an encryption key back to the access point, which is used to encrypt the connection.

This configuration (alphanumeric soup: EAP-TLS via WPA2/802.1x) means that the client doesn't share a simple secret with the server.

share|improve this answer
No, the certificate doesn't need a passwords, just as certificates from websites don't have passwords: the purpose of them is to say 'look at me, I have the key, let me in!'. This technique can be combined with a username/password pair but it's not necessary. – Flup Jun 7 '13 at 14:21
As I said: the certificate doesn't need a password. It can have one, but doesn't need one. – Flup Jun 7 '13 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .