FreeRadius: 802.1X EAP

https://mrncciew.com/2013/03/03/eap-overview/

http://wdqfirst.blog.163.com/blog/static/1133474112011020112144862/

http://wdqfirst.blog.163.com/blog/static/1133474112011020101738131/

http://wdqfirst.blog.163.com/blog/static/11334741120110203501610/

http://blog.csdn.net/happyfyshan/article/details/2332325

理解：挑战响应

可以将上图中的角色从左到右依次认为是：手机、WIFI路由、radius server。
需要注意的是：手机和路由之间是802.1X协议，如EAP等; 路由和Radius服务器之间是Radius协议。
例如CISCO路由器会选择EAP而不是PAP、CHAP。
经过抓包，RV110W Wireless-N VPN Firewall 会使用EAP-PEAP与客户端通信。

Radius Package Format

Authenticator

The NAS and RADIUS server share a secret. That shared secret
followed by the Request Authenticator is put through a one-way
MD5 hash to create a 16 octet digest value which is xored with
the password entered by the user, and the xored result placed

EAP

http://wenku.baidu.com/link?url=nzAAWt2l5fPVsiBmz9tiMN4LRWpow7pjOBDXMmQ4uOCpOct31vxzNEIRwou15vqT0JlZcPAl8k7rTUVisMvUO1_xHM2Ixg4Sn2dTKkRKijW
请先阅读上面的文章。

Radius数据包中可以包含EAP数据包。

EAP

EAP Packet Format

https://tools.ietf.org/html/rfc3748#page-20

对于cisco路由器

http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/ht_8021x.html
cisco路由器支持EAP-PEAP

EAP-PEAP

http://wenku.baidu.com/link?url=nzAAWt2l5fPVsiBmz9tiMN4LRWpow7pjOBDXMmQ4uOCpOct31vxzNEIRwou15vqT0JlZcPAl8k7rTUVisMvUO1_xHM2Ixg4Sn2dTKkRKijW
http://blog.chinaunix.net/xmlrpc.php?r=blog/article&uid=26422163&id=3456339

TLS/SSL

http://www.ruanyifeng.com/blog/2014/09/illustration-ssl.html