Just when you thought the industry had enough Extensible Authentication Protocol - EAP - methods to last a lifetime (read here about the whole heap) ...think again.

Apparently, a new version of Protected EAP, or PEAP, will soon be emerging for use in Wi-Fi hot spots. Called PEAP-Type, Length, and Value (PEAP-TLV), the new flavour is being created at the IETF with strong influences by Microsoft.

It aims to secure the initial authentication message in a public wireless network and, potentially, create a secure 802.1X framework for hotspots in general.

The initial idea is to protect the first connection during which a would-be user of a wireless ISP (WISP) hot spot service signs on to the service and gains access by presenting a valid (and confidential) credit card number.

Handshakes in the clear
Some hot spots support HTTPS/SSL (Secure Sockets Layer) using a captive portal for that initial sign-on. But currently, in many WISP implementations, that initial handshake takes place in the clear. The reason is that, by definition, public networks are open networks, inviting usage and commerce.

Also, in HTTPS/SSL environments, while the transaction session is encrypted, the subsequent public sessions - Web browsing, instant messaging, public e-mail - are not, leaving public hot spot traffic vulnerable to attack. WISPs could offer more mature hotspot services that enforce security if something like PEAP-TLV were to become available.

Sources indicate that PEAP-TLV is scheduled to become available in Microsoft XP's Service Pack 2 for clients, due this quarter, and will run on the Microsoft Internet Authentication Service (IAS), the Windows implementation of a RADIUS server and proxy. (IAS plays the role of "authentication server" in 802.1X
parlance.)

In such a scenario, IAS would be configured as a RADIUS server to authenticate and authorise users in a Microsoft Active Directory connecting to the WISP network.

PEAP-TLV will reportedly provide IAS with the ability to send the location of the provisioning server to wireless client computers in the form of a URL. With the URL of the provisioning server, wireless clients can download provisioning XML files and begin the initial sign-up or subscription renewal process. In other words, clients get authenticated to some network resources immediately, enabling them to pay for service securely, before then gaining access to network resources at large.