I'm having trouble finding results for the internal workings of WiFi Protected Setup. All I can find is that the PIN method is broken, evil and cracked, and that you should turn off WPS PIN or WPS altogether... and that some routers don't even do that, so it's best to just not use routers that have WPS at all. All the results I find seem to be articles about how bad the WPS Pin is. When they do mention push button, it's as a "safe" alternative.
I am in need of some technical clarity.
How does the encryption for WiFi Protected Setup via Push Button Configuration work?
If a wifi device does not support using WPA/WPA2, could it still connect if it had WPS Push Button?
The WPS protocol consists of a series of EAP message exchanges that are triggered by a user action, relying on an exchange of descriptive information that should precede that user's action. The descriptive information is transferred through a new Information Element (IE) that is added to the beacon, probe response, and optionally to the probe request and association request/response messages. Other than purely informative type-length-values, those IEs will also hold the possible and the currently deployed configuration methods of the device.
EAP is Extensible Authentication Protocol, and it's apparently included by default (at least one version is, EAP-TLS) in WPA and WPA2.
WPA and WPA2 use various encryption algorithms to authenticate a device that wishes to access the Access Point.
Can one bypass these encryption algorithms by simply using WPS Push button, sending EAP-TLS messages to authenticate?