How does EAP-FAST work ?
A. EAP-FAST uses symmetric key algorithms to achieve a tunneled authentication process. The tunnel establishment relies on a Protected Access Credential (PAC) that EAP-FAST can be provisioned and managed dynamically by EAP-FAST through the authentication, authorization, and accounting (AAA) server (such as the Cisco Secure Access Control Server [ACS] v. 3.2.3). With a mutually authenticated tunnel, EAP-FAST offers protection from dictionary attacks and man-in-the-middle vulnerabilities. Here are the phases of EAP-FAST: EAP-FAST not only mitigates risks from passive dictionary attacks and man-in-the-middle attacks, but also enables secure authentication based on currently deployed infrastructure. • Phase 1: Establish mutually authenticated tunnel—Client and AAA server use PAC to authenticate each other and establish a secure tunnel. • Phase 2: Perform client authentication in the established tunnel—Client sends user name and password to authenticate and establish client authorization po
