TechKnowSurge
CompTIA Security+ 3.2 ISC2 CISSP 5.6 NIST CSF PR.AA-03 CompTIA Security+ 4.1 NIST 800-53 IA-2
TechKnowSurge Catalog Videos Extensible Authentication Protocol (EAP)
VideoSecurityFree

Extensible Authentication Protocol (EAP)

Extensible Authentication Protocol (EAP) is a widely used authentication framework that defines how authentication protocols should be structured, enabling a flexible range of methods such as EAP-TLS, EAP-MD5, and EAP-FAST. It supports diverse credential types including certificates, pre-shared keys, and username-password combinations.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Extensible Authentication Protocol (EAP) sits at the center of modern network authentication, but unlike its name might suggest, it is not a protocol itself. EAP is a framework, meaning it defines the rules and structure that authentication protocols must conform to rather than directly handling authentication exchanges. This distinction places EAP in a different category from earlier authentication protocols such as Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP), both of which are concrete implementations with fixed behaviors and well-documented limitations. From the EAP framework, a broad set of EAP methods are derived, each designed to address specific use cases and security requirements. EAP-TLS uses digital certificates for strong mutual authentication, EAP-FAST was developed as a faster and more flexible alternative, EAP-POTP supports one-time passwords, and pre-shared key methods provide another option for environments where certificate infrastructure is not in place. Some older methods, such as EAP-MD5, are now considered outdated and have been replaced by more secure alternatives, demonstrating one of EAP's core strengths: the ability to evolve without requiring a complete overhaul of the underlying framework. In practice, when a client device initiates a connection to a network resource or service, EAP allows both parties to negotiate which authentication method will be used based on what each side supports. This negotiation enables organizations to deploy authentication strategies that match their infrastructure, whether that means installing certificates on endpoint devices, issuing smart cards to users, or relying on standard username-and-password credentials. The flexibility and extensibility built into the EAP framework make it a foundational component of enterprise network security and a critical concept for anyone working in network or cybersecurity roles.

What you'll learn

What's covered

Extensible Authentication Protocol (EAP)

Aligned to

CompTIA Security+
3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
4.1 Given a scenario, apply common security techniques to computing resources.
ISC2 CISSP
5.6 Implement authentication systems
NIST CSF
PR.AA-03 Users, services, and hardware are authenticated.
NIST 800-53
IA-2 Identification and Authentication (Organizational Users)

Key terms

Authentication
The process of verifying the identity of a user, device, or system.
Extensible Authentication Protocol
EAP
Extensible Authentication Protocol is a flexible authentication framework used in wireless networks and PPP connections that supports multiple authentication methods including certificates, tokens, and passwords.
EAP Method
A specific authentication protocol built upon the EAP framework, each designed to support a particular use case such as certificates, passwords, or pre-shared keys.
EAP Transport Layer Security
EAP-TLS
An EAP authentication method that uses TLS with mutual digital certificate authentication for both the client and the authentication server. EAP-TLS is considered one of the most secure 802.1X authentication methods and is widely used in enterprise wireless and wired networks.
Digital Certificate
An electronic document that uses a digital signature to bind a public key with an identity.
Point-to-Point Protocol
PPP
A data link protocol used to establish a direct connection between two nodes.
Multi-Factor Authentication
MFA
An authentication method that requires users to provide two or more verification factors to gain access.

Topics

Extensible Authentication Protocol Eap Methods Network Authentication Eap Tls Identity And Access Management Cybersecurity

Transcript

Authentication protocols

One of the most well-used authentication protocols nowadays is EAP, or extensible authentication protocol.

Authentication protocols is just a generic term that we use to describe all the protocols that are used to communicate between different devices, or users and devices, or users and certain resources, in order to gain access to it. So it's an authentication that happens, hence the authentication protocols, but it's the actual protocol that's being communicated back and forth.

There are a lot of authentication protocols. In fact, if you look at the Wikipedia article on authentication protocols, this is how it breaks it down. We've developed these authentication protocols over time. One of the initial ones was password authentication protocol, or PAP. This one had some real weaknesses to it, so CHAP came out, or challenge handshake protocol. And now one of the newer ones is extensible authentication protocol.

EAP is a framework, not a protocol

Although this is different than these other two. In fact, this is not a protocol at all. Despite what the name says, it's actually a framework.

What is this framework? Extensible authentication protocol is a framework. Think of a framework as being like the blueprints to the house, versus the protocol as being the house. What is a blueprint? A blueprint describes how the house should be constructed, and then the protocol actually constructs it. Same thing when it comes to these authentication protocols: EAP is just the framework. It specifies how these protocols should look, and then there are a lot of protocols that are built towards this EAP. You can think of it as maybe a standard, or this blueprint.

EAP methods

So what are the actual protocols then that are associated with EAP? We call these EAP methods. Some examples of these are EAP-TLS, or TLS. We've got EAP-MD5, EAP-FAST. So we've got different methods that are built off of the EAP framework.

There are a lot of EAP methods — here's a list of many of the EAP methods. So why are there so many? It just depends on what our use cases are. There are a lot of different use cases out there. Some of these are outdated, so we produce different ones. Like EAP-MD5 is considered an outdated one now. But maybe we want to use certificates — well, the TLS one will use certificates. Or maybe we want to use a one-time password — well, that's what this POTP one is. Or maybe we want to do a pre-shared key.

So that allows us to create this framework. EAP creates this framework that then we can build these standards off of, and now we can choose what standards we want to use, what protocols we want to use, depending on what our scenario is. It makes it much more dynamic when we're implementing these, and also it makes it much more dynamic from a progression standpoint, because we can upgrade these as technologies get old and we need to improve upon them.

What this allows us to do

What this allows us to do is, I can be on my laptop connecting into maybe a server or a service and I need to be authenticated. Well, maybe I want to have different methods available. So we discuss back and forth through these protocols and say, okay, what method are we going to use? Maybe we are going to use a pre-shared key, or maybe we're going to use a certificate, or maybe we're going to use some user credentials, in order to exchange this information and authenticate either the user or the device, or a service on this device, to the service or the resource that we're trying to access.

So this allows me to use those credentials by entering a username and password and gaining access to those resources, or using something like certificates. That certificate could be installed on the computer, so I would install a certificate on the computer and that grants me access to those resources. Or maybe it's a certificate on a smart card — so I've got a smart card, and then when I scan that, that certificate grants me access. So it's like a form of credentials; it's to me rather than the device itself. So it gives me a lot of variety from that perspective.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →