EAP Host Architecture

For easier development of EAP authentication methods for IEEE 802.1X-authenticated wireless connections, Windows Vista and Windows 7 support a new EAP architecture called EAPHost. EAPHost provides the following features that are not supported by the EAP implementation in earlier versions of Windows:

• Network Discovery EAPHost supports Network Discovery as defined in the "Identity selection hints for Extensible Authentication Protocol (EAP)" Internet draft.
• RFC 3748 compliance EAPHost will conform to the EAP State Machine and address a number of security vulnerabilities that are specified in RFC 3748. In addition, EAPHost will support additional capabilities such as Expanded EAP Types (including vendorspecific EAP methods).
• EAP method coexistence EAPHost allows multiple implementations of the same EAP method to coexist simultaneously. For example, the Microsoft version of Protected EAP (PEAP) and the Cisco Systems, Inc. version of PEAP can be installed and selected.
• Modular supplicant architecture In addition to supporting modular EAP methods, EAPHost also supports a modular supplicant architecture in which new supplicants can be added easily without having to replace the entire EAP implementation.

For EAP method vendors, EAPHost provides support for EAP methods already developed for Windows Server 2003 and Windows XP, as well as an easier method of developing new EAP methods. Certified EAP methods can be distributed with Windows Update. EAPHost also allows better classification of EAP types so that the built-in 802.1X- and PPP-based Windows supplicants can use them.

For supplicant method vendors, EAPHost provides support for modular and pluggable supplicants for new link layers. Because EAPHost is integrated with NAP, new supplicants do not have to be NAP aware. To participate in NAP, new supplicants only need to register a connection identifier and a callback function that informs the supplicant to re-authenticate.