¿Qué es la autenticación PEAP? Cómo PEAP protege su WiFi

What Is PEAP Authentication? How PEAP Secures Your WiFi. A Purple Enterprise WiFi Intelligence Briefing. Welcome. If you're responsible for network security at a hotel group, a retail estate, a stadium, or a public-sector organisation, this briefing is for you. Over the next ten minutes, we're going to cover PEAP authentication — what it actually is, how it works under the hood, where it fits in your security architecture, and critically, when it's the right call versus when you should be looking at something stronger. Let's get into it. Section one: Context and why this matters right now. Most enterprise WiFi deployments today still rely on one of two authentication models. You've either got a pre-shared key — a single password shared across the organisation — or you've got 802.1X, which is the IEEE standard for port-based network access control. PEAP sits firmly in the 802.1X camp, and it's by far the most widely deployed EAP method in corporate and institutional environments globally. The reason PEAP became so dominant is straightforward: it solved a real operational problem. Before PEAP, deploying certificate-based WiFi authentication meant issuing client certificates to every device — every laptop, every phone, every tablet. For an organisation with five hundred employees and a BYOD policy, that's a PKI deployment headache that most IT teams simply didn't have the budget or the time for. PEAP offered a middle path: strong server-side authentication via TLS, with username and password credentials on the client side. No client certificates required. That compromise made PEAP the de facto standard for enterprise WiFi authentication through the 2000s and 2010s, and it remains extremely common today. Understanding its architecture — and its limitations — is essential for anyone making infrastructure decisions in 2024 and beyond. Section two: Technical deep-dive. Let's walk through exactly what happens when a device authenticates via PEAP. The process has two distinct phases, and understanding both is critical. The three actors in this exchange are: the supplicant — that's the client device, whether it's a laptop, a smartphone, or an IoT terminal; the authenticator — typically the wireless access point or the wireless LAN controller; and the authentication server — almost always a RADIUS server, such as Microsoft NPS, FreeRADIUS, or a cloud-hosted RADIUS service. Phase one is TLS tunnel establishment. When the supplicant attempts to connect, the authenticator doesn't grant access immediately. Instead, it initiates an EAP exchange over the local network — this is EAPOL, EAP over LAN. The authenticator forwards this to the RADIUS server, which presents its server-side TLS certificate to the client. The client validates that certificate against its trusted certificate store. If validation succeeds, a TLS tunnel is established between the client and the RADIUS server. This tunnel is encrypted — typically TLS 1.2 or 1.3 in modern deployments. Phase two is inner authentication. Inside that encrypted tunnel, the actual credentials are exchanged. In the most common deployment — PEAP-MSCHAPv2 — the client sends a username and password using the Microsoft Challenge Handshake Authentication Protocol version 2. The RADIUS server validates those credentials against its identity store, which might be Active Directory, LDAP, or a cloud identity provider. If the credentials check out, the RADIUS server sends an Access-Accept message back through the authenticator, and the client is granted network access. The key security property here is that the MSCHAPv2 exchange happens inside the TLS tunnel. An attacker passively monitoring the wireless channel cannot see the credentials in transit. That's the core value proposition of PEAP. Now, where does PEAP-MSCHAPv2 fall short? There are two significant issues that any security-conscious architect needs to understand. First: server certificate validation. PEAP only requires the server to present a certificate — it does not require the client to present one. This creates a well-documented attack vector. If a client device is misconfigured to accept any certificate — or to accept certificates from any CA — an attacker can stand up a rogue access point, present a fraudulent certificate, and intercept the MSCHAPv2 handshake. Tools like hostapd-wpe have made this attack trivially accessible. The mitigation is rigorous supplicant configuration: enforce server certificate validation, pin the expected CA, and specify the server's common name. This is non-negotiable in any serious deployment. Second: MSCHAPv2 is an older protocol with known weaknesses. The 2012 research by Moxie Marlinspike demonstrated that MSCHAPv2 challenge-response pairs can be cracked offline with sufficient compute. If an attacker does capture the inner authentication exchange — for example through the rogue AP attack described above — they can attempt to recover the plaintext password offline. The strength of your password policy therefore directly affects your exposure. Long, complex, randomly generated passwords significantly reduce this risk. Compare this to EAP-TLS, where both the server and the client present certificates. There are no passwords to steal. The attack surface is dramatically reduced. The trade-off is operational complexity: you need a PKI, you need to issue and manage client certificates, and you need a mechanism to distribute them to every device. For organisations with a mature MDM deployment and a well-managed PKI, EAP-TLS is the gold standard. For everyone else, PEAP-MSCHAPv2 with rigorous configuration remains a defensible and practical choice. Section three: Implementation recommendations and pitfalls. Let me give you the practical deployment guidance. These are the things that separate a secure PEAP deployment from a vulnerable one. Number one: enforce server certificate validation on every supplicant. This is the single most important configuration item. In Windows, this is the "Validate server certificate" checkbox in the wireless network profile. In iOS and Android, it's the CA certificate field in the EAP configuration. If this is not configured, your PEAP deployment is vulnerable to rogue AP attacks regardless of how well everything else is set up. Number two: deploy via MDM or GPO, not manual configuration. Manual configuration by end users is unreliable. Users will click through certificate warnings. They will misconfigure the CA field. Push your wireless profiles via Microsoft Intune, Jamf, or Group Policy. This ensures consistent, policy-compliant supplicant configuration across your estate. Number three: use TLS 1.2 as a minimum on your RADIUS server. Disable TLS 1.0 and 1.1. Most modern RADIUS implementations support this, but it's worth verifying — particularly on older on-premises deployments. Number four: integrate with your identity provider. PEAP-MSCHAPv2 authenticates against a credential store. That store should be your authoritative identity provider — Active Directory, Azure AD via NPS extension, or a cloud RADIUS service with LDAP integration. This means that when an employee leaves, disabling their account immediately revokes their WiFi access. No shared secrets to rotate, no manual deprovisioning. Number five: consider your guest network separately. PEAP is an enterprise authentication method. For guest WiFi — where you're onboarding visitors, customers, or event attendees — you need a different approach. Platforms like Purple provide a purpose-built guest WiFi layer that handles captive portal authentication, data capture, and analytics without requiring RADIUS infrastructure on the guest SSID. Keep your enterprise SSID on 802.1X with PEAP, and your guest SSID on a separate, isolated network with appropriate onboarding. Number six: plan for certificate rotation. Your RADIUS server certificate will expire. When it does, every client that has pinned that certificate will fail to authenticate until the new certificate is distributed. Build certificate renewal into your operational calendar — at least 90 days before expiry — and test the rotation process in a staging environment before rolling it out to production. The most common failure modes I see in the field are: certificate validation not enforced, leading to rogue AP vulnerability; RADIUS server certificates that expire without warning, causing widespread authentication failures; and MSCHAPv2 inner authentication exposed because the RADIUS server is accessible from the wrong network segment. All three are avoidable with proper planning. Section four: Rapid-fire questions. Can PEAP work with cloud identity providers like Azure AD? Yes. Microsoft's NPS extension for Azure AD MFA allows you to proxy PEAP authentication through Azure AD, enabling multi-factor authentication on your WiFi. Alternatively, cloud RADIUS services like Cisco ISE, Aruba ClearPass, or JumpCloud RADIUS can integrate directly with Azure AD or Okta. Is PEAP compliant with PCI DSS? PEAP-MSCHAPv2 can be used in PCI DSS environments, but you need to ensure server certificate validation is enforced, TLS 1.2 or higher is in use, and the RADIUS server is properly segmented. PCI DSS 4.0 tightens requirements around network access controls — review the relevant requirements with your QSA. Should I migrate from PEAP to EAP-TLS? If you have a mature MDM deployment and the operational capacity to manage a PKI, yes — EAP-TLS is the stronger choice. If you're managing a mixed estate with personal devices, legacy hardware, or limited MDM coverage, PEAP-MSCHAPv2 with rigorous configuration remains appropriate. This is a risk-based decision, not a binary one. What about WPA3-Enterprise? WPA3-Enterprise mandates 192-bit security mode for high-security environments, but it still supports EAP methods including PEAP. WPA3 improves the over-the-air encryption but does not change the EAP authentication exchange itself. Section five: Summary and next steps. To bring this together: PEAP is a two-phase authentication protocol that wraps inner credentials — typically MSCHAPv2 — inside a TLS tunnel. It's the most widely deployed 802.1X EAP method because it eliminates the need for client certificates while still providing strong server authentication. Its primary vulnerability is rogue AP attacks enabled by misconfigured supplicants that don't validate the server certificate. Mitigate this through MDM-enforced wireless profiles, CA pinning, and server name validation. For most enterprise WiFi deployments — corporate offices, hotel back-of-house networks, retail staff networks — PEAP-MSCHAPv2 with proper configuration is a sound, defensible choice. For high-security environments, regulated industries, or organisations with mature PKI infrastructure, EAP-TLS provides meaningfully stronger security and should be the target architecture. If you're also running guest WiFi alongside your enterprise network — and most of you are — remember that PEAP is not the right tool for guest onboarding. Look at platforms like Purple, which provide purpose-built guest WiFi authentication with analytics, data capture, and marketing integration, keeping your guest and enterprise traffic properly separated and your compliance posture intact. For further reading, check out Purple's guides on RADIUS server architecture and enterprise WiFi authentication. Links are in the show notes. Thanks for listening. This has been a Purple Enterprise WiFi Intelligence Briefing.