TL;DR
PEAP (Protected Extensible Authentication Protocol) strengthens wireless network security by wrapping the traditional Extensible Authentication Protocol (EAP) authentication process inside a Transport Layer Security (TLS) tunnel. Unlike basic EAP, PEAP shields credential exchanges from interception across both of its two authentication phases. It is natively supported in Microsoft environments via EAP-MSCHAPv2, making it a practical and widely adopted choice over alternatives like Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS).
What is PEAP?
PEAP is a security protocol used to better secure WiFi networks.
How many people within your organization are tapping away on computers plugged into the walls of your headquarters?
Chances are, some (or even) all of your company's employees work outside of the building from time to time. In fact, Stanford University suggests that working from home is the new normal, as more than 42 percent of people logged on remotely during the pandemic. And even when we're back in the office, we'll probably use laptops and phones to work.
If you use WiFi to help these employees connect, whether they're inside the building or away from it, you could encounter significant security risks.
PEAP was created to help. For years, programmers have used something called EAP to manage wireless connections. PEAP is a version of this technology, and it comes with enhanced security protections.
Why does standard EAP have security gaps?
In a traditional EAP, systems use a public key system to connect. If a user can prove credentials (such as entering a user name/password), the server then passes a public key to complete the transaction, and the users have an encryption key to decode it.
Unfortunately, the entering of passwords and trading of keys can happen in unprotected spaces in an EAP. That leaves your system wide open for hacking.
PEAP combines the speed of EAP with a TLS tunnel. The entire communication between a client and the server is protected within that TLS tunnel. PEAP doesn't describe a specific method. Instead, it calls for chaining multiple EAP mechanisms together.
How does PEAP work?
A high-level overview of PEAP authentication
The coding and technology behind PEAP are complex. Even Microsoft says that the average user working in a small office doesn't need to understand the ins and outs of complex security features like this.
But digging into a high-level overview of the technology could help you understand how PEAP protects data as it moves between two parties.
Connecting with a server and gaining access is called authentication, and it typically involves several steps. The PEAP protocol involves two phases.
- Phase 1: The Authenticator attached to the user's device sends an EAP-Request/Identity message. The client can reply with a true identity or a version that is anonymized, so it's harder to steal.
The handshake between the two devices begins. In essence, the two systems jump through a basic challenge at this stage, but there's more work to be done.
- Phase 2: The EAP server sends another message, asking for the true identity of the user. The two strengthen their connection, and a channel opens.
Here, a deeper connection is formed, and the systems trade keys. Since this step happens so late in the process, under protections of the TLS tunnel, it's very hard to crack or manipulate.
Look over the illustration for a detailed description of all of the steps involved in authentication. As a user, you may never see all the work happening behind the scenes.
And the time lapse is minimal. With proper programming, you'll wait just seconds for the two systems to chat, connect, and let you through.
What tools are used in Phase 2 of PEAP authentication?
Use PEAP protocols, and you'll take authentication through two phases. You'll need a secondary tool to make the jump from phase one to phase two.
Your options include:
- EAP-MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2). When bundled with PEAPv0 (version 0), this is one of the most common forms of PEAP in use today. It comes standard with Microsoft products, and it handles the details of the second handshake in Phase 2 of authentication.
- EAP-GTC (Generic Token Card). This product is meant to bundle with PEAPv1 (version 1), and it works with products outside of the Microsoft environment. Since it takes some coding know-how to implement and its counterpart does not, this is rarely used.
How PEAP credentials are stored after authentication
The jumble of letters and numbers can be confusing. But the benefits are clear.
When you're using a PEAP method, with either of these helpers, you're proving that you deserve to have access to the server. You'll only need to prove that once, as your credentials are stored within the system. During your career with the organization, you may never have to update your password (or remember it) ever again. Your time savings could be immense.
How does PEAP compare to EAP-TTLS?
As we've mentioned, PEAP uses TLS to make messages secure and protected. But other systems also use TLS. As a network administrator, you have options.
For example, some companies avoid PEAP, and they use something called EAP-TTLS instead. This product offers certificate-based authentication through a tunnel, very much like PEAP.
| Feature | PEAP | EAP-TTLS |
|---|---|---|
| Uses TLS tunnel | Yes | Yes |
| Bundled with Microsoft products | Yes | No |
| Proprietary protocol | No | Yes |
| Ease of deployment in Microsoft environments | High | Low — requires manual installation |
Let Okta help protect your data
WiFi makes connections simple. People within range just need to know the right credentials, and they're ready to connect.
But WiFi does come with some security risks, and finding them isn't always easy. Let us help.
At Okta, we can help you examine your setups and patch lapses that put your security at risk.
Frequently asked questions
What makes PEAP (Protected Extensible Authentication Protocol) more secure than standard Extensible Authentication Protocol (EAP)?
Standard EAP exchanges credentials and keys in unprotected spaces, leaving the process vulnerable to interception. PEAP addresses this by enclosing the entire client-server communication inside a Transport Layer Security (TLS) tunnel, ensuring that sensitive credential exchanges happen in a protected environment.
What are the two phases of PEAP (Protected Extensible Authentication Protocol) authentication?
In Phase 1, the authenticator sends an identity request and the client responds — optionally with an anonymized identity — initiating a basic handshake. In Phase 2, the server requests the user's true identity, a deeper connection is established, and cryptographic keys are exchanged securely within the TLS tunnel.
What is EAP-MSCHAPv2 and why is it commonly used with PEAP (Protected Extensible Authentication Protocol)?
EAP-MSCHAPv2 (Microsoft Challenge Handshake Authentication Protocol version 2) is the secondary tool used in Phase 2 of PEAPv0 authentication. It is one of the most widely deployed PEAP configurations because it ships natively with Microsoft products, reducing the need for additional installation or configuration.
When would you use EAP-GTC (Generic Token Card) instead of EAP-MSCHAPv2?
EAP-GTC (Generic Token Card) is designed for use with PEAPv1 and is intended for non-Microsoft environments. However, because it requires additional coding expertise to implement — unlike EAP-MSCHAPv2 — it sees relatively limited adoption in practice.
How does PEAP (Protected Extensible Authentication Protocol) differ from Extensible Authentication Protocol-Tunneled Transport Layer Security (EAP-TTLS)?
Both PEAP and EAP-TTLS (Extensible Authentication Protocol – Tunneled Transport Layer Security) use a TLS tunnel for certificate-based authentication. The key difference is that PEAP is bundled natively into Microsoft products, while EAP-TTLS is a proprietary protocol that must be manually installed on each device, making PEAP the more practical choice for most organizations.
Do users need to manage or remember passwords when using PEAP (Protected Extensible Authentication Protocol)?
Once a user authenticates successfully via PEAP, their credentials are stored within the system. This means users may not need to update or remember their password again throughout their time with the organization, significantly reducing authentication friction.
References
Stanford Research Provides a Snapshot of a New Working-From-Home Economy. (June 2020). Stanford University.
802.1X Overview and EAP Types. (October 2020). Intel.
1.3 Overview. (October 2020). Microsoft.
Microsoft's Windows Still Synonymous With Computer. (March 2020). Statista.
