ertificate based authentication between client and server, and can also dynamically generate keys to encrypt subsequent data transmissions. An EAP-TLS authentication exchange requires both the station and the authentication (RADIUS) server to prove their identities to each other using public key cryptography and the exchange of digital certificates (see next section). The client station validates the authentication server's certificate and sends an EAP response message that contains its certificate and starts the process of negotiating encryption parameters, such as the cipher type that will be used for encryption. As shown in Figure 8-6, once the authentication server validates the client's certificate, it responds with the encryption keys to be used during the session. EAP-TLS therefore requires initial configuration of certificates on both the client station and the authentication server, but once this is established by the network manager no further user intervention is required. On the client station, the certificate must be protected by a passphrase or PIN, or stored on a smart card. The result is a very high level of wireless security although, for large WLAN installations, the requirement to manage both client and server certificates as well as the Wireless LAN Intranet / LAN Supplicant Authenticator Authentication = Client = Access server Server EAPOL Start EAP Identity Request Request Client for Identity Authenticator makes Access EAP Identity Response RADIUS Access Request Request with User ID EAP - TLS Start Start EAP - TLS exchange EAP Response (Client -Hello) EAP Request (Request client certificate) Server sends certificate EAP Response (Client certificate and cipher specification) Client verifies Server certificate EAP Request (Cipher specification) Server verifies Client certificate EAP Response TLS finished EAP Success RADIUS Access Success Client derives Session key EAPOL Multicast Key Authenticator delivers multicast EAPOL Session Parameters key encrypted with session key Figure 8-6: EAP-TLS Au