http://www.dslreports.com/forum/r20737630 en Wed, 11 Nov 2009 14:49:22 EDT Wed, 11 Nov 2009 14:49:22 EDT http://www.dslreports.com/forum/remark,20738232 jbibe : I don't know.]]> http://www.dslreports.com/forum/remark,20738232 Thu, 03 Jul 2008 17:30:07 EDT http://www.dslreports.com/forum/remark,20737953 docrice : I haven't read through that thread you linked, but that's quite interesting and I never thought of this. Thanks for the info. Do you know if this is also the case with other AAAs such as IAS, ACS, or SBR?]]> http://www.dslreports.com/forum/remark,20737953 Thu, 03 Jul 2008 16:29:38 EDT http://www.dslreports.com/forum/remark,20737630 jbibe : About two years ago, Jason Cohen discussed the fact that the default TLS cipher suite suggested by a Windows XP station and accepted by FreeRADIUS during WPA and WPA2 authentication is:

TLS_RSA_WITH_RC4_128_MD5

In its default state, FreeRADIUS selects the first suite in the client list. Jason recommended changing the FreeRADIUS configuration to select a stronger cipher suite from the list. For more information, see:

»Questions about WPA2 and WPA

A quick test today verified that Windows XP with SP3 sends the same 11 cipher suites, in the same order, and that the FreeRADIUS server selects the first cipher suite, as before.

I also ran some tests using a Vista station. The first cipher suite in the Vista client list is:

TLS_RSA_WITH_AES_128_CBC_SHA

Again, FreeRADIUS selects the first suite. This cipher suite is a major improvement.]]> http://www.dslreports.com/forum/remark,20737630 Thu, 03 Jul 2008 15:23:36 EDT