thentication Exchange Wireless LAN Security public key infrastructure (PKI) required for certificate validation can become a significant network management task. EAP-TTLS (Tunnelled transport layer security) and PEAP (Protected extensible authentication protocol) are alternatives to EAP-TLS that dispense with the client side certificate, and the associated implementation and administration overhead. The client station confirms the identity of the authentication server by verifying its digital certificate using PKI, and then a one-way TLS tunnel is set-up allowing the client's authentication data (password, PIN, etc.) to be encapsulated as TLS messages and securely transported to the authentication server. Public Key Infrastructure A public key infrastructure (PKI) enables digital certificates to be used to electronically identify an individual or an organisation. A PKI requires a certificate authority (CA) that issues and verifies digital certificates, a registration authority (RA) that acts as the verifier of the CA when a new digital certificate is issued, and a certificate management system, including one or more directory services where the certificates and their public keys are stored. When a certificate is requested, a CA simultaneously creates a public and private key using an algorithm such as RSA (see Glossary). The private key is given to the requesting party and the public key is lodged with a publicly available directory service. The private key is held securely by the requesting party and is never shared or sent across the Internet. It is used to decrypt messages that have been encrypted with the related public key, accessed from the public directory by the party sending the message. A PKI enables a user to digitally sign a message by encrypting using a private key, and allows a recipient to check the signature by retrieving the sender's public key and using this to decrypt the message. In this way the parties can establish user authentication, as well as message privacy and integrity, without the ne