Why does 802.1X with PEAP-MSCHAPv2 still admit an attacker holding a password pulled from a stolen laptop image, and what does EAP-TLS cost instead?

## What 802.1X actually decides 802.1X is port-based admission. Until the supplicant on the connected device answers, the switch port passes EAPOL and nothing else; the authenticator relays the exchange to an authentication server over RADIUS, and the server returns accept or reject. The important thing for this question is the narrowness of what an accept means: **an acceptable credential was presented on that port**. It does not mean a device you own is attached, that the device is patched, or that the person you think is using it is present. Everything else you believe about the port is inference from which credential was accepted — which is exactly why the choice of credential decides how much your programme is worth. ## What PEAP-MSCHAPv2 proves PEAP builds a TLS tunnel to the authentication server and runs an inner authentication inside it. With MSCHAPv2 as the inner method, that inner authentication is a challenge/response over the account's password (in practice, its NT hash). The attraction is obvious and it is why estates still run it: you already have a directory full of passwords, so the credential exists on the day you turn 802.1X on, no per-device work required. The problem is what kind of secret a password is. It is **knowledge**, and knowledge is copyable: - it can be recovered from a stolen or decommissioned machine's disk image, including from cached material; - it is the same secret used for mail, VPN and file shares, so any theft anywhere becomes network admission; - MSCHAPv2's challenge/response is weak enough that a captured exchange can be attacked offline to recover the hash; - and for network authentication the hash is as good as the password. None of that requires the attacker to have your hardware. They plug their own laptop into a port — a meeting room, a reception desk, a socket behind a screen — present the credential, and 802.1X accepts, because 802.1X was asked whether the credential was acceptable and it was. ## What EAP-TLS changes EAP-TLS replaces knowledge with **possession**. The client presents a certificate and proves it holds the matching private key. If that key pair was generated on the device and the key is non-exportable — better, held in a TPM — then copying the certificate is useless: the certificate is public, the key is what authenticates, and the key does not leave. An attacker with a full image of the user's mailbox, password and browser profile still cannot stand up a laptop that the port will accept. A short comparison of what each admits: | Credential | What an accept proves | What a thief needs | |---|---|---| | PEAP-MSCHAPv2 | a valid account secret was presented | the password or its hash, from anywhere | | EAP-TLS, exportable key | someone holds a copy of a key | one file copy off a machine | | EAP-TLS, device-bound key | that specific device is present | the physical device | ## What it costs, and why that is the real question The cost is not licensing and it is not the switches. It is **one touch per endpoint, before enforcement day**. Every device must receive a credential through some channel — a management tool driving an enrolment protocol such as SCEP or EST, a pre-staging step at build time, or a person at a desk. That has three consequences an interviewer will push on: 1. **You need a pipeline before you need a credential.** A device with no certificate cannot reach the network to obtain one, so the design has to include how the first credential arrives. 2. **The denominator is not the asset register.** You must enrol the devices that are actually on the wire, and those two sets never match. 3. **Some devices cannot hold any credential.** They fall to a separate, deliberately narrow fallback design, and the count of them is a number you produce, not a surprise you discover on cutover morning. The honest senior position is that the credential you can deploy is bounded by the enrolment capability you can fund and schedule. Running PEAP-MSCHAPv2 knowingly, with a narrow blast radius and a dated plan to replace it, is defensible. Running it while telling a customer that 802.1X means only their devices get on the network is not — the accept proves someone knew a password, and passwords leave buildings.