Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication

Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication Moustafa Ibrahim∗ , Bin Han∗ , Hans D. Schotten∗† ∗

arXiv:2610.01580v1 [cs.CR] 1 Oct 2026

†

RPTU Kaiserslautern-Landau, Kaiserslautern, Germany German Research Center for Artificial Intelligence (DFKI), Kaiserslautern, Germany

Abstract—Credential-based Extensible Authentication Protocol (EAP) authentication cannot distinguish a legitimate credential holder from an adversary using compromised credentials. Physical Layer Deception (PLD) complements credential-based authentication by exposing a deceptive primary object over a primary transport while a separate recovery object travels with differentiated reliability over a secondary channel. Existing PLD studies remain, to our knowledge, at the physical/linkmodel level; using PLD’s activation/deactivation mechanism as an authentication gate creates an authentication-specific design requirement, since an all-inactive attempt would exercise no recovery path. We present a batched PLD-based re-verification step for Enterprise Wi-Fi’s TEAP/RADIUS/IEEE 802.11 authentication chain, implemented end to end across the server, access point, and device in the open-source hostap 2.12 codebase. Each attempt carries three rounds, at least one active, with no dedicated activation flag. Across four campaigns totaling 1593 attempts, the prototype evaluates batched recovery behavior, rejects the implemented naive credential-bearing attacker in all 30 attempts, measures successful-path latency, and evaluates the security-reliability trade-off for one, two, and three active rounds under two modeled recovery regimes. The evaluation exercises the protocol and software-MAC behavior directly and analyzes informed and retry-seeking attackers under the software recovery model. Index Terms—Physical layer deception, EAP authentication, Wi-Fi security, RADIUS, TEAP, IEEE 802.11

I. I NTRODUCTION Enterprise wireless local area networks commonly employ IEEE 802.1X-based port access control [1], where a claimant’s Extensible Authentication Protocol (EAP) [2] exchange is relayed through an access point to a RADIUS [3] server, often via Tunnel EAP (TEAP) [4]. Such schemes authenticate whoever presents valid credentials: once credentials are cloned, exfiltrated, or otherwise compromised, an adversarial claimant becomes indistinguishable from the legitimate device at the credential layer alone. Physical-layer security complements credential-layer decisions with channel/hardware evidence difficult for a remote party to reproduce [5]: channel-based authentication verifies continued presence via time-variant channel characteristics [6], and challenge-response variants such as PHY-CRAM [7] extend this to an explicit exchange [8], [9]. Physical Layer Deception (PLD) is a distinct, active mechanism: it exposes a deceptive primary object over a primary transport while a separate, differentiated-reliability recovery object lets a favorably placed receiver recover the true value more reliably than a disadvantaged one [10]–[13].

To our knowledge, existing PLD studies do not address integrating PLD’s activation/deactivation mechanism into a running EAP stack. Applying that mechanism as an authentication gate creates an authentication-specific design requirement: at least one active round must occur, since an allinactive attempt would expose every true challenge and never exercise the recovery path. The proposed scheme satisfies this requirement with a batch of L rounds and exactly A active positions, enforcing A ≥ 1. Integrating PLD into EAP-TEAP is further a cross-layer placement problem: the primary object must stay opaque to the access point inside the TEAP/TLS tunnel, while the recovery object reaches the device over a separate IEEE 802.11 path, correlated without a fixed arrival order, using only existing TEAP, RADIUS, and IEEE 802.11 extensibility. The proposed scheme resolves this placement problem and addresses the design requirement described above. Our contributions are: (i) a standards-aware cross-layer integration of PLD into EAPTEAP/RADIUS/IEEE 802.11, preserving TEAP opacity for primary objects while exporting recovery objects over separate Category-127 MAC frames; (ii) an authentication-specific batched construction with L rounds and exactly A active positions, A ≥ 1 in normal operation, inactive litter, no activation flag, and all-round final gating; (iii) an end-to-end hostap 2.12 implementation across the server, access point, and device, evaluated under mac80211_hwsim through four campaigns totaling 1593 attempts covering batched recovery behavior, a naive-attacker baseline, latency, and the securityreliability trade-off; and (iv) an analytical informed-attacker and reliability treatment, including an adaptive retry-seeking attacker that exploits repeated observations of the same recovery object, deriving false-accept, PLD-induced false-reject, and retry/security trade-off behavior, with overhead derived from the implemented message formats and a proposed bounded fresh-session retry policy. The remainder of the paper is organized as follows. Section II presents the proposed design; Section III analyzes attacker and reliability behavior; Section IV describes the implementation and evaluation; and Section V concludes. II. PLD AUTHENTICATION M ODEL AND BATCHED R E -V ERIFICATION D ESIGN A. PLD Mechanism PLD pairs a primary object, carried over a primary transport, with a recovery object carried over a separate transport with

(a) Active, recovered

(b) Active, missed

(c) Inactive

pi , ki fresh, ki ̸= 0

pi , ki fresh, ki ̸= 0

pi only, no ki used

mi = pi ⊕ ki

mi = pi ⊕ ki

mi = pi

recovery: VALID K EY(k̂i )

recovery: N O VALID K EY

litter → N O VALID K EY

p̂i = mi ⊕ k̂i = pi (correct)

p̂i = mi ̸= pi (deceptive)

p̂i = mi = pi (correct)

same decoder-level outcome: N O VALID K EY

Per attempt: a batch of L rounds, exactly A active, 1 ≤ A ≤ L (A ≥ 1 in normal operation); active positions chosen uniformly without replacement, no dedicated activation flag transmitted; the server accepts only if all L rounds verify.

Fig. 1. PLD re-verification decision semantics for one round under the three decoder cases.

differentiated reliability. The proposed re-verification applies this to a per-round true challenge pi : on an active round the server exposes mi = pi ⊕ ki for a fresh nonzero key ki (so mi ̸= pi ), paired with a genuine key-bearing recovery object; on an inactive round it exposes mi = pi directly, paired with a same-length but non-key-bearing litter object, so the object’s presence alone never reveals inactivity. A receiver that recovers a valid key (VALID K EY) reconstructs p̂i = mi ⊕ k̂i = pi ; otherwise it falls back to p̂i = mi (N O VALID K EY), which is correct on an inactive round but wrong on an active one whose recovery failed. Fig. 1 illustrates all three outcomes. An inactive litter object that fails validation and an unrecovered active recovery object are both mapped to N O VALID K EY, invoking the same fallback p̂i = mi . The random-guess baseline of Section III-B assumes that no side information distinguishes the two cases. An intact active recovery object instead lets a party confirm activation through the public validity check of Section II-C. An inactive round exposes mi = pi , so an all-inactive attempt would bypass the recovery path. We therefore select exactly A ≥ 1 active positions uniformly without replacement and transmit no activation flag; all L responses must verify. Randomized placement contributes the combinatorial uncertainty in Eq. (5) when unresolved active positions must be A inferred, while the Perception result rE and Bob’s marginal acceptance under i.i.d. recovery do not depend on placement. B. Threat Model The proposed scheme targets a claimant that already holds compromised client credential material and can complete ordinary EAP-TEAP/EAP-TLS authentication unassisted; it adds a PLD-oriented post-credential re-verification step gating final EAP-Success. TLS protects mi from third-party observers, but the credential-bearing claimant terminates its own TEAP/TLS session and therefore observes mi ; the proposed scheme discriminates claimants through recovery-path reliability. We denote the legitimate receiver by Bob and the credentialbearing claimant by Eve, with per-round recovery probabilities rB and rE , respectively. We assume a Kerckhoffs-style

adversary that knows the full construction, including L and the active-set distribution, but not its per-attempt realization. The server and access point are trusted; the backend RADIUS path is outside this adversary’s observation, integrity-protected by the RADIUS Message-Authenticator. For an inactive round mi already equals the true value pi ; for an active round, an adversary that reliably obtains both mi and that round’s recovery object recovers pi . Section III quantifies what an adversary without such reliable recovery can still achieve. C. Batched Construction and Protocol Mapping Mapping PLD’s primary/recovery split onto batched EAPTEAP requires keeping TEAP/TLS opacity for primary objects, exporting each round’s recovery object to the access point as its own access-point-to-device MAC frame correlated per round by TxnID/Round with no fixed arrival order, guaranteeing A ≥ 1, and gating authentication on all L rounds verifying, using only existing TEAP/RADIUS/IEEE 802.11 extensibility. Each round i is either active or inactive, chosen by the server: ( pi ⊕ ki , i active, mi = (1) pi , i inactive, where pi is drawn uniformly from the 128-bit strings and, for an active round, ki uniformly from the nonzero 128-bit strings, so mi ̸= pi . Conditioned on an active mi , pi remains one of 2128 − 1 other values; Section III-B uses this quantity for the blind-guess baseline. Every round carries a 32-byte recovery-path object; an active round’s is the codeword qi = ki ∥ ti , ti = Trunc128 SHA256(ℓQ ∥ TxnIDBE64
∥ Roundi,BE16 ∥ ki ) ,

(2)

where ℓQ is a fixed public recovery-code domain-separation label, BE64 and BE16 denote 64- and 16-bit big-endian encodings, respectively, and ki is included both as-is and inside ti ’s hash input. Decoding Eq. (2) takes the first 128 bits as a candidate key k̂i and recomputes ti : a match yields VALID K EY(k̂i ), a mismatch N O VALID K EY. This check is public and unkeyed, so any party holding an intact active qi and its TxnID/Round can recompute it. The public check establishes codeword validity only. An inactive round’s object is litter: an independently random 32byte candidate checked against the same test; one redraw is attempted on accidental validation, and a second accidental validation fails batch construction safely rather than deliver litter that decodes VALID K EY. No dedicated active/inactive flag or activation-mask field is transmitted; the active-set realization is maintained as server state; the same public-validity-check ambiguity of Section II-A applies to this wire encoding of Eq. (1). A legitimate receiver reconstructs ( mi ⊕ k̂i , VALID K EY, p̂i = (3) mi , N O VALID K EY,

which equals pi on an active round decoded VALID K EY with k̂i = ki , and trivially on any inactive round. Let L be the batch size; the server selects exactly A of the L rounds as the active set A, by the placement rule of Section II-A. Normal operation enforces 1 ≤ A ≤ L. At A = 0, every mi = pi , so the batch exposes every true value directly and a claimant needs no recovery; A = 0 is retained only as the explicitly authorized all-inactive diagnostic condition of Section IV-C, not during normal operation. The device returns Ri = HMAC-SHA256 p̂i , ℓR ∥ TxnIDBE64
∥ Roundi,BE16 ∥ LBE16 ,

Access Point

Auth. Server

Device

RADIUS Access-Challenge: EAP-Msg{TEAP Batch Request[m1 , . . . , mL ]} + L VSAs{q1 , . . . , qL } Primary path: 802.11 Data/EAPOL{EAPTEAP/TLS[Batch Request m1 , . . . , mL ]} Recovery path: L separate Category-127 Action frames (one per round): q1 , . . . , qL

(4)

where ℓR is a fixed public response domain-separation label and LBE16 encodes the batch size L; the server independently recomputes this per round, keyed on its own pi , accepting the batch only if all L rounds occur exactly once and every Ri of Eq. (4) matches. One TEAP Vendor-Specific TLV carries all L values m1 , . . . , mL from server to device, opaque to the access point: Type 7, under RFC 9930 [4], where we use VendorId 0x00FFFFFE as a laboratory placeholder. Each qi instead travels as its own RADIUS Type-26 VSA [3], [14], all L attached to the same Access-Challenge. After the access point verifies the RADIUS Message-Authenticator, it extracts the L recovery VSAs and forwards each qi as its own Category-127 IEEE 802.11 Vendor-Specific Action frame [15]. Category127 provides the existing vendor-specific carrier; the semantics of the proposed scheme and the laboratory Vendor-Id remain implementation-specific. A batch thus produces one Batch Request, L VSAs, L Action frames, and one Batch Response, correlated by TxnID/Round, reflecting TEAP-opacity preservation while exposing recovery objects separately, as illustrated in Fig. 2. The proposed re-verification is an auxiliary post-innermethod TEAP Phase-2 TLV exchange that preserves the standard TEAP key-derivation procedure and operates alongside Crypto-Binding before the final Result TLV, following RFC 9930 Appendix C.8 [4]. After accepting the Batch Request, the device waits 2000 ms by default for missing qi ; unresolved rounds then take the N O VALID K EY branch of Eq. (3), correct only if that round is inactive. EAP retransmission may resend the stored Batch Request without regenerating its session-bound objects, and received qi values remain cached by TxnID/Round. The access point does not re-send a recovery Action frame merely because the stored EAP request is retransmitted; repeated observations of the same object arise only from lower-layer retransmissions. Malformed, missing, duplicate, or mismatched Batch Responses fail the batch. A new authentication session generates a fresh TxnID, active set, pi , ki , mi , and qi . III. ATTACKER AND R ELIABILITY A NALYSIS A. Receiver and Attacker Strategies Given the construction above, the legitimate receiver applies Eq. (3) exactly. The naive non-deceptive attacker, evaluated in Section IV-E, sets p̂i = mi for every round regardless

correlate TxnID/Round per round decode each qi : VALID K EY/N O VALID K EY compute each p̂i ; compute each Ri Batch Response {R1 , . . . , RL } (TEAP) Batch Response {R1 , . . . , RL } (RADIUS) verify every Round 1..L occurs exactly once; verify every Ri

EAP success (gated), via AP / reject

Fig. 2. Batched PLD re-verification message flow for a batch of L rounds (L ≤ 3 evaluated). The server retains the active-set realization, the access point relays the TEAP-protected primary objects, and each recovery object is forwarded in a per-round Category-127 Action frame.

of its own decoder’s outcome, never using an available key. The informed Perception attacker, following the semantic-PLD “Perception” strategy of [12], applies the receiver’s rule with its own recovery probability rE in place of rB , using a correctly recovered key when available and without requiring A’s realization. The informed random-guess attacker also knows L, A, and the challenge-space size but must simultaneously guess any unrecovered active round’s position and value. An attacker may also withhold its response or exploit an available retry mechanism to obtain additional independent observations of the same recovery object before responding; Section III-C analyzes this channel-independent repeated-observation strategy. Channel-state-aware attempt selection is outside the scope of the current analysis. B. False Acceptance and PLD-Induced False Rejection Let dp =128 be the true-challenge bit-length. As Section II-C defines, an active round’s true pi is uniform, absent recovery, over the 2dp − 1 values other than mi , so a blind guess succeeds with probability 1/(2dp − 1). For this baseline, rounds without VALID K EY are assumed observationally indistinguishable: the attacker gets no delivery-state signal separating received litter from a missed active object. For the informed random-guess attacker, let T be the number of active rounds whose true value it obtains without guessing (e.g. with probability rE each); conditioned on T = t it must still guess the remaining active positions and values:  A−t 1 1 PRG (accept | T = t) = L−t
. (5) 2dp − 1 A−t

Its unconditional false-accept probability, for i.i.d. per-round recovery with probability rE (T ∼ Binomial(A, rE )), is A   X A t RG PFA = rE (1 − rE )A−t PRG (accept | T = t). (6) t t=0 Eq. (6) assumes the observational indistinguishability above; side information identifying inactive positions instead conditions the combinatorial factor on the remaining candidates, decreasing it toward one. Eq. (5) therefore defines the decoderoutput baseline under this ambiguity; side information narrows the remaining candidate set. The informed Perception attacker instead guesses nothing: writing T for the number of active-round keys it correctly recovers, it falsely accepts exactly when T = A, Perception PFA = Pr(T = A),

(7)

which, under i.i.d. recovery, reduces to Perception A PFA = rE .

(8)

Symmetrically, with rB the legitimate receiver’s per-round recovery probability, the PLD-induced false-reject probability is PLD A PFR = 1 − rB , (9) conditioned on successful primary/TEAP delivery. Eqs. (8)–(9) Perception PLD give the trade-off directly: PFA falls and PFR rises as A increases, raising the recovery burden on an informed attacker at the cost of higher legitimate rejection unless rB is correspondingly high. A A /rB closed forms hold only under i.i.d. per-round The rE recovery, specializing the general joint probability Pr(T = A) of Eq. (7) for correlated or position-dependent recovery; all false-accept expressions neglect the negligible probability of an accidental HMAC-SHA256 match. C. Repeated Observations and Retry Policy Because the PLD mechanism is public, Eve need not accept a single observation: withholding a response or exploiting an available retry mechanism can yield further independent observations of the same recovery object. The attempts considered here are channel-independent: the retry decision does not condition on instantaneous channel state. Let J denote the number of statistically independent effective observations of the same active recovery object, including lower-layer retransmission opportunities. The prototype enforces the batch and failure-handling behavior of Section II-C, which permits J to exceed 1 through lower-layer retransmission. Under J i.i.d. observations, the effective per-round recovery probability becomes rE,J = 1 − (1 − rE )J ,

(10)

which tends toward 1 as J grows even for small rE . Under equal J across the A active rounds, the retry-aware falseaccept probability is  A retry (11) PFA = 1 − (1 − rE )J ,

the retry-aware analogue of Eq. (8). The same retry opportunity is available to the legitimate receiver: with rB,J = 1 − (1 − rB )J , retry A PFR = 1 − rB,J . (12) A Increasing J raises both Bob’s acceptance probability rB,J retry and Eve’s false-accept probability PFA of Eq. (11) together. The failure handling of Section II-C limits same-object observations to lower-layer retransmissions: a failed batch terminates TEAP, whereas a new authentication session uses fresh objects. For N independent fresh sessions with per-session falseaccept probability PFA ,

PFA,N = 1 − (1 − PFA )N .

(13)

We therefore propose N ≤ Nmax followed by backoff/ratelimiting and a suspicious-retry alarm. Nmax remains a deployment parameter because the same policy also limits legitimate devices on persistently poor channels. Randomized placement affects Eq. (5) only while active positions remain unresolved. Eqs. (10)–(13) assume independent observations or sessions. IV. P ROTOTYPE AND E VALUATION A. Implementation We implement the proposed scheme as additions to hostap 2.12: an Authentication Server built on hostap’s integrated RADIUS/EAP server, an Access Point (hostapd), and a Device (wpa_supplicant), evaluated under the software MAC-level simulator mac80211_hwsim. The server executes each attempt as one L ≤ 3-round batch, L = 3 evaluated. It assigns a fresh TxnID, selects A active positions by the placement rule of Section II-A, builds each mi /qi , and sends one Batch Request TLV and L RADIUS VSAs on the same Access-Challenge. The server precomputes every Ri and withholds EAP-Success unless the Batch Response contains every Round 1..L exactly once with every Ri matching; any malformed, missing, duplicate, or incorrect material rejects the batch. We disable outer TEAP session resumption so every measured authentication executes the full batch. The access point performs ordinary relay, never terminating or decrypting TEAP, so it never sees plaintext mi . After the access point verifies the RADIUS Message-Authenticator, it parses the L VSAs and forwards each qi , unexamined, as its own Category-127 Action frame. The access point forwards active codewords and litter identically; validity checking occurs at the device. The device correlates each round’s mi /qi by TxnID/Round without assuming a fixed arrival order, including a qi that arrives before the Batch Request, which it caches pending the request. It applies the public decoder to each available qi , waits up to the 2000-ms recovery deadline for any outstanding round, computes all L response tags, and returns them in one Batch Response. Action-frame reception requires sourceaddress/TxnID/Round correlation and is registered through the nl80211 driver and exercised through mac80211_hwsim.

Theory PFA

Theory PFR

Full-stack PFR

(b) rB = 0.90, rE = 0.70

(a) rB = 0.95, rE = 0.50

0.8

Probability

Full-stack PFA

0.6 0.4 0.2 0.0

1

2

3

1

2

3

Number of active rounds, A A and P A Fig. 3. Security-reliability trade-off versus the number of active rounds A. Lines show the analytical PFA = rE FR = 1 − rB characteristics; markers show full-stack proportions from 100 attempts per condition with 95% Wilson confidence intervals.

TABLE I BATCHED RECOVERY- MODEL CAMPAIGN , 273 ATTEMPTS . Mode L A Recov. Pos. Accept Ordinary TEAP – – – – 30/30 Full recovery 3 1 full R 30/30 Full recovery 3 3 full – 30/30 Degraded recovery 3 1 r = .95 F 29/30 Degraded recovery 3 1 r = .95 R 29/30 Degraded recovery 3 3 r = .95 – 26/30 Degraded recovery 3 1 r = .50 F 15/30 Degraded recovery 3 1 r = .50 R 15/30 Degraded recovery 3 3 r = .50 – 1/30 Diagnostic 3 0 all qi withheld – 3/3 r: software recovery-model parameter; F = fixed mask; R = randomized position; A = 0 diagnostic only.

B. Experimental Setup We run four campaigns under mac80211_hwsim, all with L = 3. The 273-attempt recovery-model campaign covers the ten conditions in Table I. A 30-attempt naive-attacker campaign uses an isolated test-only device binary with the server and access point unchanged. A 90-attempt latency campaign uses 30 attempts each of ordinary TEAP and the A ∈ {1, 3} full-recovery cases. The 1200-attempt trade-off campaign covers two modeled recovery regimes, A ∈ {1, 2, 3}, and Bob and Perception-Eve roles, with 100 attempts per condition. Each campaign uses a pre-generated fixed schedule; degraded and trade-off recovery probabilities are realized through controlled per-round recovery-object withholding. The shared 2000-ms deadline of Section II-C resolves rounds still missing at expiry as N O VALID K EY. Reported latency covers EAP-start-toEAP-success on the accept path only; reject-path timing is qualitative. C. Batched Recovery-Model Evaluation Table I summarizes 273/273 complete attempts, with no infrastructure failures or unexplained timeouts. Ordinary TEAP

and both full-recovery cases accept 30/30. Under degraded recovery, acceptance falls as the recovery probability decreases. The fixed and randomized A = 1 conditions give the same counts at both tested recovery probabilities, as expected under i.i.d. recovery. The A = 0 diagnostic accepts 3/3 with all recovery objects withheld because every round is inactive, which motivates A ≥ 1 in normal operation. D. Security-Reliability Trade-off Evaluation To evaluate the trade-off in Eqs. (8) and (9), we use two modeled recovery regimes, (rB , rE ) = (0.95, 0.50) and (0.90, 0.70), with L = 3 and A ∈ {1, 2, 3}. For each regime and A, 100 Bob attempts estimate PFR from the reject rate and 100 Perception-Eve attempts estimate PFA from the accept rate. Both roles use the same device binary and decoding rule; only the modeled recovery probability differs. Fig. 3 compares these proportions with the analytical curves and 95% Wilson confidence intervals. Increasing A lowers analytical PFA and raises analytical PFR in both regimes. Finite recovery realizations from the pre-generated schedules and randomized active-set placement produce sampling variation around the nominal curves. All 1200 attempts reach an authentication accept/reject decision, with zero infrastructure failures or unexplained timeouts, and all 1200 outcomes match the accept/reject decision predicted from the realized active set and recovery-object delivery. E. Naive Credential-Bearing Attacker Baseline We evaluate the naive attacker strategy of Section III-A over 30 attempts, using authorized laboratory credential material at the L = 3, A = 1 randomized-position full-recovery configuration. All 3 recovery frames arrive in every attempt; the active round decodes VALID K EY and both inactive rounds decode N O VALID K EY, confirming that a valid active-round key goes deliberately unused. The HMAC-mismatch set matches exactly the active round in every attempt, and all 30 attempts

were rejected, with zero unexpected accepts and no infrastructure failure. This result covers this one strategy at this one configuration. The semantic-PLD Perception strategy, which uses the available key, is analyzed in Section III-B.

in hostap 2.12 and evaluated through complementary fullstack campaigns alongside analytical informed-attacker, repeated-observation, and reliability models.

F. Authentication Latency

This work was supported in part by the collaborative NSFDFG SaTC 2.0 RES project TrustWISC under Grant HA 8970/5-1, and in part by the DFG project TapE under Grant HA 8970/6-1. B. Han (bin.han@rptu.de) is the corresponding author. OpenAI’s GPT assisted with debugging of the simulation codes and language polishing of the manuscript.

A dedicated campaign of 30 isolated attempts each of ordinary TEAP, L=3, A=1 full recovery, and L=3, A=3 full recovery, 90 total and all accepted, measures mean successfulpath EAP-start-to-EAP-success latency at 231.698 ms, 257.096 ms, and 256.558 ms, respectively: the proposed re-verification adds approximately 25 ms of successful-path EAP latency over ordinary TEAP in this mac80211_hwsim testbed for both full-recovery configurations. Attempts missing a required active recovery object instead follow the separate reject path, waiting for the 2000-ms recovery deadline before rejecting at approximately 2.4–2.5 s, a timing reported qualitatively. G. Protocol Overhead Each transport leg’s overhead is derived from the implemented message formats and expressed as B(L) = B0 + B1 L bytes at L = 3: the TEAP Batch Request/Response TLVs are 19 + 18L/19 + 34L (73 B/121 B), the L RADIUS recovery VSAs total 50L (150 B), and the L Category-127 Actionframe bodies total 49L (147 B). Because these quantities occur on three distinct transport hops, we report them separately. V. D ISCUSSION AND C ONCLUSION We verify the batched construction, guaranteed A ≥ 1, randomized positions, litter, and all-round gate across the recovery-model, trade-off, naive-attacker, and latency campaigns. We derive the Perception, random-guess, and repeatedobservation results under their independence assumptions. The current analysis is channel-independent: rB and rE are modeled per-round recovery probabilities, and Eve’s retry decision does not condition on instantaneous channel state. Channel-state-aware attempt selection, correlated fading, and more general joint recovery/observation models remain open for physical-layer evaluation. Physical-layer validation of the modeled recovery asymmetry and missed-active/litter reception remains open, together with mapping L, A, and the recovery codeword to Wi-Fi modulation-and-coding or finiteblocklength parameters, cryptographic origin authentication of Category-127 recovery frames, relay/collusion resistance, real-hardware evaluation, general adaptive attackers beyond the channel-independent repeated-observation model, and the cross-session retry policy implementation. The testbed’s open association without RSN or Protected Management Frames is an evaluation configuration, not a protocol requirement. Outer TEAP session resumption remains disabled. At dp = 128, challenge recovery dominates the mask-guess contribution to an informed random-guess attacker’s success probability. The proposed batched PLD re verification realizes an authentication-oriented step within EAPTEAP/RADIUS/IEEE 802.11, implemented end-to-end

ACKNOWLEDGMENT

R EFERENCES [1] IEEE Standard for Local and Metropolitan Area Networks – Port-Based Network Access Control, IEEE Std 802.1X-2020, IEEE Std., Feb. 2020. [2] B. Aboba, L. Blunk, J. Vollbrecht, J. Carlson, and H. Levkowetz, “Extensible authentication protocol (EAP),” IETF RFC 3748, Jun. 2004. [3] C. Rigney, S. Willens, A. Rubens, and W. Simpson, “Remote authentication dial in user service (RADIUS),” IETF RFC 2865, Jun. 2000. [4] A. DeKok, “Tunnel extensible authentication protocol (TEAP) version 1,” IETF RFC 9930, Feb. 2026. [5] H. V. Poor and R. F. Schaefer, “Wireless physical layer security,” Proceedings of the National Academy of Sciences, vol. 114, no. 1, pp. 19–26, 2017. [6] L. Xiao, L. J. Greenstein, N. B. Mandayam, and W. Trappe, “Using the physical layer for wireless authentication in time-variant channels,” IEEE Transactions on Wireless Communications, vol. 7, no. 7, pp. 2571–2579, 2008. [7] D. Shan, K. Zeng, W. Xiang, P. Richardson, and Y. Dong, “PHY-CRAM: Physical layer challenge-response authentication mechanism for wireless networks,” IEEE Journal on Selected Areas in Communications, vol. 31, no. 9, pp. 1817–1827, Sep. 2013. [8] N. Xie, Z. Li, and H. Tan, “A survey of physical-layer authentication in wireless communications,” IEEE Communications Surveys & Tutorials, vol. 23, no. 1, pp. 282–310, First Quarter 2021. [9] X. Wang, P. Hao, and L. Hanzo, “Physical-layer authentication for wireless security enhancement: Current challenges and future developments,” IEEE Communications Magazine, vol. 54, no. 6, pp. 152–158, Jun. 2016. [10] B. Han, Y. Zhu, A. Schmeink, and H. D. Schotten, “Non-orthogonal multiplexing in the FBL regime enhances physical layer security with deception,” in 2023 IEEE 24th International Workshop on Signal Processing Advances in Wireless Communications (SPAWC), 2023, pp. 211– 215. [11] W. Chen, B. Han, Y. Zhu, A. Schmeink, G. Caire, and H. D. Schotten, “Physical layer deception with non-orthogonal multiplexing,” IEEE Transactions on Wireless Communications, vol. 24, no. 5, pp. 3923– 3936, May 2025. [12] B. Han, Y. Zhu, A. Schmeink, G. Caire, and H. D. Schotten, “A semantic model for physical layer deception,” in 2025 IEEE International Conference on Communications (ICC), Montreal, QC, Canada, 2025, pp. 4129–4134. [13] W. Chen, B. Han, Y. Zhu, A. Schmeink, and H. D. Schotten, “Physical layer deception in OFDM systems,” in 2025 Joint European Conference on Networks and Communications & 6G Summit (EuCNC/6G Summit), Security Aspects and Quantum Communications Track, 2025, pp. 715– 720. [14] B. Aboba and P. Calhoun, “RADIUS (remote authentication dial in user service) support for extensible authentication protocol (EAP),” IETF RFC 3579, Sep. 2003. [15] IEEE Standard for Information Technology – Telecommunications and Information Exchange between Systems – Local and Metropolitan Area Networks – Specific Requirements – Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications, IEEE Std 802.11-2024, IEEE Std., Apr. 2025.

Related documents

• Protocol Integration of Physical Layer Deception into EAP-TEAP Wi-Fi Authentication#1156851
• Extensible Authentication Protocol (EAP) Attributes for Wi-Fi Integration with the Evolved Packet Core#420773
• Encrypted Signaling Transport Modes for the Host Identity Protocol#501412
• Association-based Privacy Attacks in Wireless Protocols: Formal Modeling and Mitigation#447894
• A Lightweight Hybrid Authentication and Key Agreement Protocol for Decentralized Device-to-Device Communication with Post-Quantum Confidentiality.#232587