Device Credentials Cisco TrustSec supports password-based credentials. Cisco TrustSec authenticates the supplicants through passwords and uses MSCHAPv2 to provide mutual authentication. The authentication server uses these credentials to mutually authenticate the supplicant during the EAP-FAST phase 0 (provisioning) exchange where a PAC is provisioned in the supplicant. Cisco TrustSec does not perform the EAP-FAST phase 0 exchange again until the PAC expires, and only performs EAP-FAST phase 1 and phase 2 exchanges for future link bringups. The EAP-FAST phase 1 exchange uses the PAC to mutually authenticate the authentication server and the supplicant.
Cisco TrustSec uses the device credentials only during the PAC provisioning (or reprovisioning) steps. When the supplicant first joins the Cisco TrustSec domain, the authentication server authenticates the supplicant and pushes a shared key and encrypted token to the supplicant with the PAC. The authentication server and the supplicant use this key and token for mutual authentication in all future EAP-FAST phase 0 exchanges. User Credentials Cisco TrustSec does not require a specific type of user credential for endpoint devices. You can choose any type of user authentication method that is supported by the authentication server, and use the corresponding credentials.
For example, the Cisco Secure Access Control System (ACS) version 5.1 supports MSCHAPv2, generic token card (GTC), or RSA one-time password (OTP). Protected Access Credential (PAC) The PAC is a unique shared credential used to mutually authenticate client and server. It is associated with a specific client username and a server authority identifier (A-ID). A PAC removes the need for Public Key Infrastructure (PKI) and digital certificates. Creating a PAC consists of the following steps: 1. Server A-ID maintains a local key (master key) that is only known by the server. 2.
When a client, which is referred to in this context as an initiator identity (I-ID), requests a PAC from the server, the server generates a randomly unique PAC key and PAC-Opaque field for this client. 3. The PAC-Opaque field contains the randomly generated PAC key along with other information such as an I-ID and key lifetime. 4. PAC Key, I-ID, and Lifetime in the PAC-Opaque field are encrypted with the master key. 5. A PAC-Info field that contains the A-ID is created. 6. The PAC is distributed or imported to the client automatically. The server does not maintain the PAC or the PAC key, enabling the EAP-FAST server to be stateless.
Note Cisco TrustSec Overview Device Credentials Cisco TrustSec Overview 5