WPA-Enterprise and 802.1X

In short: WPA-Enterprise secures Wi-Fi (and wired networks) with individual credentials per person instead of a shared password. The basis is the 802.1X standard.

In more detail: The device signs in at the access point, which passes the check on to a RADIUS server. Only on success does the access point allow traffic.

In Depth

• Roles: Supplicant (the device), authenticator (access point or switch), authentication server (RADIUS).
• EAP methods: EAP-TLS (certificates on device and server, most secure), PEAP and EAP-TTLS (username and password in a protected tunnel).
• Advantages: Everyone has their own data, so individuals can be blocked without changing the Wi-Fi password for all. Each session gets its own keys.
• Pitfall: Devices must verify the server certificate. Without that check, people can fall for fake access points.
• Use: Companies, schools, universities (eduroam). Also wired at switch ports.
• Home network: For home a good WPA3 password is simpler. See Wi-Fi security.

See also: certificate chain and PKI