3 ms·
That's not how TLS / PEAP works. It's asymmetric cryptography initially (to agree a symmetric key). That's why it's important the client verifies it does not ta
by usr1106 5y ago
That's not how TLS / PEAP works. It's asymmetric cryptography initially (to agree a symmetric key). That's why it's important the client verifies it does not talk to a rogue server.
- tinus_hn 5y agoYes, that is true. But the information gained by the server if it is rogue is limited, you aren’t directly sending the password. That is the point. Practically the step of verifying the server is very hard because the client UI doesn’t provide a way; there is no agreement on what the certificate should be.