 authentication protocol (CHAP), is negotiated between client and the remote access server when a connection is established and then the chosen protocol is used to authenticate the connection. EAP extended this structure by allowing the use of arbitrary authentication mechanisms, called EAP types, which define various structures for the authentication message exchange. When a WLAN connection is being established, client and access point agree on the use of EAP for authentication, and a specific EAP type is chosen at the start of the connection authentication phase. The authentication process then consists of the exchange of a series of messages between the client and authentication server, the length and detail of the exchange depending on the requested connection parameters and the selected EAP type. Some of the most common EAP types are described below. When EAP is used together with RADIUS as the authentication protocol, EAP messages sent between the access point and the authentication server will be encapsulated as RADIUS messages, as shown in Figure 8-5. Extensible Authentication Protocol over LANs To apply EAP to LANs or WLANs rather than to dial-up connections, extensible authentication protocol over LAN (EAPoL) was defined in the Wireless LAN Security 802.1x standard as a transport protocol for delivering authentication messages. EAPoL defines a set of packet types that carry authentication messages, the most common of which are; EAPoL-Start - Sent by the authenticator to start an authentication message exchange EAP-Packet - Carries each EAP message EAPoL-Key - Carries information related to generating keys EAPoL-Logoff - Informs the authenticator that the client is logging off. EAP Types EAP types supported by the Wi-Fi Alliance's interoperability certification programme include; EAP-TLS, EAP-TTLS/MS-CHAP v2, PEAP v0/EAP-MS-CHAP v2, PEAP v1/EAP-GTC and EAP-SIM. To give a flavour of how these EAP types differ, EAP_TLS, EAP-TTLS and PEAP are briefly described here. EAP-TLS (Transport layer security) uses c