Looking at the WPA2 (Entreprise, let's say PEAP-MSCHAPv2) Wi-Fi protocol, I understand that since WPA2 uses Open System Authentication, and that 802.1X authentication takes place before the 4-way handshake, the initial EAP-Request/Identity and EAP-Response/Identity exchange takes place in the clear. Am I mistaken ?

1 Answer 1


I just checked by monitoring my phone connecting to eduroam, and the answer is yes, the outer identity is transmitted in some EAP Response, Identity message and is not encrypted. Which is probably why two identities are required: the "anonymous" identity for the outer identity request, and the inner identity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.