Windows Mobile 6.5 802.1X Authentication Methods

Windows Mobile 6.5 provided built-in support for enterprise-grade 802.1X wireless authentication to secure corporate network connections. While the operating system natively included core Extensible Authentication Protocol (EAP) methods like PEAP-MSCHAPv2 and EAP-TLS, hardware manufacturers frequently expanded this list through proprietary Wi-Fi supplicants to support Cisco extensions and legacy protocols.

Native 802.1X Authentication Methods

Out of the box, the native Windows Mobile 6.5 wireless client supported the following standard EAP types under both WPA-Enterprise and WPA2-Enterprise (using AES or TKIP encryption):

  • PEAP-MSCHAPv2 (Protected EAP): The most common enterprise method, using a server-side digital certificate to create an encrypted TLS tunnel. Inside this tunnel, the user or device authenticates using standard Active Directory credentials (username and password).
  • EAP-TLS (Transport Layer Security): The most secure native method, requiring mutual authentication. Both the RADIUS server and the Windows Mobile device require valid X.509 digital certificates installed to verify identities.

OEM and Third-Party Extended Methods

Because Windows Mobile 6.5 was widely deployed on rugged industrial devices (such as those from Motorola Solutions, Intermec, and Honeywell), manufacturers routinely embedded third-party supplicants (like the Summit Client Utility or Funk Odyssey Client) or Cisco Compatible Extensions (CCX). These implementations added support for:

  • LEAP (Lightweight EAP): A Cisco-proprietary, password-based authentication protocol historically common in legacy Cisco wireless networks.
  • EAP-FAST (Flexible Authentication via Secure Tunneling): Developed by Cisco to replace LEAP, this method uses Protected Access Credentials (PACs) rather than digital certificates to establish an authenticated tunnel.
  • EAP-TTLS (Tunneled Transport Layer Security): Extends TLS authentication to support non-Windows authentication databases, allowing various client-side authentication mechanisms inside an encrypted tunnel.