Wireless authentication

Wireless authentication

Wireless network used to be protected by the WEP standard, but WEP turned out to be insecure and thus useless.
These days wireless networks are usualy protected using WPA – Wi-Fi Protected Access.

Unfortunatly WPA is available in several flavors and versions, see
the Wi-Fi Alliance website for details.

If your wireless network is set up to ask for authentication using client certificates,
then you can use it with those certificates and keys on your smart card.

For windows the windows build in WPA client should work well, if you have a CSP installed that works with OpenSC.
This is untested, please report your results.

For linux you can use the WPA Supplicant or Xsupplicant with OpenSC.
The support for smart cards is implemented in both via the PKCS#11 Engine for OpenSSL.

WPA Supplicant

To use WPA Suppplicant with smart card authentication you need to compile it with smart card support. Your config file should include this line:

# Smartcard support (i.e., private key on a smartcard), e.g., with openssl

	
engine.

CONFIG_SMARTCARD=y

Also you need to edit wpa_supplicant.conf like this:

# OpenSSL Engine support

	
These options can be used to load OpenSSL engines.
	
make the pkcs11 engine available

pkcs11_engine_path=/usr/lib/engine/engine_pkcs11.so
	
configure the path to the pkcs11 module required by the pkcs11 engine

pkcs11_module_path=/usr/lib/engine/opensc-pkcs11.so

X Supplicant

It looks like xsupplicant is always compiled with smart card support.

To enable it, edit the xsupplicant.conf config file and look for lines
like these:

     # this section configures the smartcard used with eap-tls

	
for now the smartcard PIN is handled the same way as the
	
password for a private key

     smartcard {
	
this line actually enables the smartcard and makes xsupplicant use
	
the opensc engine

        engine_id = pkcs11
	
set the path to the engine

        opensc_so_path = “/usr/lib/engine/engine_pkcs11.so”
	
set the key id on the smartcard

        key_id = 45

     }

FIXME: someone should test this and check if it works as advertised.