Corriente offers Wi-Fi authentication at a small-office price: Corriente introduces Elektron this week, a $299 software package for Windows and Mac OS X that provides a full 802.1X and RADIUS account management and authentication suite using WPA for encryption and PEAP or EAP-TTLS to secure the login process. The software is remarkably simple to use and can either pick up a list of users from the local machine on which it's running (Windows 2000, Server 2003, or XP, or Mac OS X 10.2.8 or later), or you can enter accounts directly. The company may add support later, possibly in a differently priced version, for external account support through a database or external RADIUS server. A fully functioning 30-day free trial is available at their downloads page. Corriente's product is a tremendous price breakthrough compared to similar offerings by enterprise-focused companies that charge thousands of dollars and often per-seat fees for a server, or even Microsoft Windows Server 2003 which includes everything Elektron offers and a full server suite at hefty per-seat licenses coupled with complexity. Elektron solves the out-of-band trust problem for using PEAP and EAP-TTLS by allowing you to use a certificate authority for Corriente on Elektron and client machines. A certificate for the Elektron server is then created against that authority. Elektron can export a Windows and Mac installer program for the root certificate authority. This allows you to install a CA in all the clients that will connect to Elektron, which lets you avoid turning off a verification option in Windows XP that enormously reduces security. On the Mac, it avoids a step in which a certificate has to be accepted, although that's less onerous, and a user can confirm the fingerprint of the certificate against details provided by the Elektron server. Elektron also allows external certificates to be used in a variety of ways. All certificate options provide for trust out of the Wi-Fi stream, which is key to any system in which security is your paramount concern. The company estimates that it's practical to run as many as thousands of 802.1X clients against a single copy of their server on a modern (not server-grade) computer. What's not practical is managing accounts at that scale, which is why I say currently Elektron is best suited for smaller installations. A related issue is that best practices would require having two 802.1X servers up and running so...
