6.3Authentication, cryptography, and PKI

Authentication, controlling "who may connect to the network," and cryptography/PKI, preventing impersonation and tampering, are the foundations of network security. A network specialist must be able to judge, for each wired LAN port or wireless access point, which authentication method (which type of 802.1X/EAP) fits the requirements, such as the operational burden of certificate management or compatibility with an existing password infrastructure.

6.3.1RADIUS and EAP

• RADIUS is a protocol that centralizes authentication, authorization, and accounting (AAA) on a single server. Instead of maintaining a separate user database at every access point, VPN device, or switch port, devices query the RADIUS server, giving centralized user management.
• EAP (Extensible Authentication Protocol) is a framework that allows the actual authentication method to be swapped in. EAP-TLS performs mutual certificate-based authentication using both a client certificate and a server certificate—the strongest option, but with a high cost of distributing and managing certificates to every client. PEAP uses a certificate only on the server side to establish a TLS tunnel, inside which the client performs lightweight authentication such as ID/password, achieving reasonable strength while keeping certificate-management costs down.

6.3.2IEEE 802.1X and authentication VLAN

• IEEE 802.1X is the standard for port-based authentication, where a switch port or wireless access point blocks communication until the connecting device is authenticated. Three roles are involved: the supplicant (the device requesting authentication), the authenticator (the switch/AP relaying the exchange at the port), and the authentication server (RADIUS server) that actually makes the authentication decision.
• Authentication VLAN dynamically assigns a connecting device to a different VLAN based on the 802.1X authentication result. An authenticated employee device is automatically placed on the business VLAN, while an unauthenticated or guest device is placed on an isolated VLAN (e.g., internet-only access), tying authentication directly to logical network segmentation.

6.3.3Cryptographic schemes and PKI

• Symmetric-key cryptography uses the same key for encryption and decryption. It is fast, but faces the key distribution problem of securely sharing a key with each peer. Public-key cryptography uses a key pair of a public key and a private key: data encrypted with the public key can only be decrypted with the corresponding private key. It solves the key distribution problem but is slower than symmetric-key cryptography, so in practice a hybrid cryptosystem—first exchanging a symmetric (session) key securely via public-key cryptography, then using symmetric-key cryptography for the rest of the communication—is common (this is how TLS is structured too).
• A digital certificate is an electronic certificate in which a CA (Certificate Authority) vouches that the holder of a public key is who they claim to be. PKI (Public Key Infrastructure) refers to the entire scheme of issuing, revoking, and verifying certificates with a CA at its apex. Verifying a server certificate confirms that the communication partner is indeed who it claims to be (not an impersonator).
• A hash function is a one-way function producing a fixed-length hash value (message digest) from data of any length, used to detect tampering. A digital signature is the hash value of a message encrypted with the sender's own private key. The recipient decrypts and compares it using the sender's public key, thereby verifying both the absence of tampering and the sender's authenticity at the same time.

Suppose a company wants to implement the requirement "only allow company-issued managed devices onto the internal wired LAN; personal devices and guests go to an isolated VLAN." As the network designer, you first deploy IEEE 802.1X on each switch port, setting up the supplicant (device), authenticator (switch), and authentication server (RADIUS server). For the authentication method, since the IT department can centrally distribute and manage certificates for company-issued devices, you adopt EAP-TLS (mutual certificate authentication) for the strongest authentication. For guest temporary access or BYOD (personal devices used for work), where certificate distribution is operationally unrealistic, you adopt PEAP, which lets you reuse existing Active Directory usernames and passwords, balancing operational cost against strength. Based on the authentication result, you use authentication VLAN to dynamically assign company devices authenticated via EAP-TLS to the business VLAN and personal devices authenticated via PEAP to a restricted-privilege guest VLAN, achieving logical separation as well. Furthermore, for access to important internal file servers, you design the operation so every file carries a digital signature to detect tampering in transit, and the receiving side verifies the sender's public-key certificate via the internal CA (PKI), confirming the file arrived from a legitimate sender without tampering. Weighing the trade-off between certificate-management burden and authentication strength, and choosing the method per target group, is the essence of this design decision.

6.3.4Section summary

• Centralize authentication with RADIUS, and authenticate per port with 802.1X (supplicant/authenticator/authentication server)
• EAP-TLS = mutual certificate authentication (strongest), PEAP = server certificate only plus lightweight authentication (lower operational cost)
• Solve the key distribution problem with public-key cryptography while keeping speed via a hybrid cryptosystem; a digital signature proves both tamper-absence and authenticity at once