Observations Some EAP methods derive keys, some don’t Where keys are derived, strength varies widely The type of keys derived varies as well Some methods derive ciphersuite-specific “session keys” Some methods derive ciphersuite-independent “master keys” Some methods describe key hierarchy, some don’t |