O impacto da autenticação mútua e simultânea com certificados X.509 no âmbito do eduroam

Abstract

The increasing vulnerability of widely-used authentication protocols, such as EAPTTLS methods, especially when they utilize vulnerable algorithms, motivates the search for more secure alternatives for federated networks like eduroam. In the context of the Brazilian academic infrastructure operated by RNP, traditional authentication methods based on EAP-TTLS with a username and password pose significant security risks. The state of the art points to EAP-TLS, which employs digital certificates for mutual authentication, as a more robust solution. However, the literature lacks quantitative performance evaluations on the impact of adopting certificates from a national Public Key Infrastructure (PKI), such as ICPEdu, in this scenario. This dissertation proposes an empirical comparative evaluation between the EAP-TLS method using ICPEdu certificates and the traditional EAP-TTLS/PAP. The qualitative results demonstrate a substantial increase in security with the adoption of EAP-TLS, which eliminates susceptibility to attacks such as credential theft. Quantitatively, the experiments, conducted in a controlled environment, revealed that authentication via EAP-TLS with ICPEdu certificates generated 29% more packet volume and a total accumulated authentication time approximately 4% longer than the legacy method. This provides concrete data to analyze the trade-off between enhanced security and network performance.