# Understanding Server Authentication in WPA3 Enterprise
## 5 Discussion
If the user actively attempts to connect while in range of an ET, the user will be presented with a warning (because the ET will present a certificate different from the one last used by the supplicant) and will have to take an important security-related decision. We will have to hope that users will take the correct decision--i.e., refuse to connect. This is almost identical to what happens today with WPA2 Enterprise (the only difference being that certain WPA2 Enterprise supplements might connect automatically even without asking the user [10]). This fact should be taken into account very carefully in roaming access services. The eduroam network, for example, allows the users of participating institutions (universities, research institutions, schools) to obtain Internet connectivity at any other participating institution by means of WPA2/WPA3 Enterprise technology. Essentially, eduroam provides a secure infrastructure for enabling supplicants to execute the authentication protocol with the AS of their home institution, irrespective of where they happen to be located [8]. The crucial point is that eduroam-enabled hot spots are available at tens of thousands of out of campus locations distributed across more than 100 countries: city centers, commercial malls, airports, railway stations, restaurants, touristic locations, and so on. Ensuring that an access point broadcasting the \"eduroam\" SSID is actually a legitimate access point is therefore made very difficult exactly by the widespread diffusion of eduroam. Users with applicants without a network profile installed and coming from organizations without any TOD policy, thus, will be required to take important security-related decisions whenever they need to connect and happen to be in range of an access point claiming to be eduroam. We believe that this fact may be critical. Similar considerations apply to govroam, a roaming access service for the public sector in the UK that is based on the same technology as eduroam and is available at more than 4000 hot-spots [25]. Based on the above considerations, roaming access services such as eduroam should leverage the policy tools at their disposal to enforce the adoption of a TOD policy by participating institutions. A normative enforcement of this kind is essential, because the default option (no TOD policy) does not require any change in the AS certificate management and is the one that requires minimum effort for administrators. The fact that many academic institutions promote supplicant configurations that are insecure but easier to describe and maintain is another important factor to consider in this respect [11]. The benefits of adopting a TOD policy are clear: they greatly reduce the opportunities for attacks aimed at impersonating AS. The corresponding costs, from the point of view of network administrators, are as follows:  
* At deployment time, TOD-STRICT has a high cost: the organization must be prepared to support users that may not be able to install the correct network profile autonomously, or that do not even know what a network profile is. TOD-TOFU has a cost probably negligible: it is reasonable to expect that most users will be able to connect their applicants autonomously, as they merely need to accept the received certificate explicitly. Of course, users must be warned that the first connection must be performed at a certainly safe location. * When the AS certificate has to be renewed or revoked, TOD-STRICT has a negligible cost, as long as the network profile consists of the root certificate and the name of the AS. TOD-TOFU may instead have a significant cost, because all the applicants that have accepted the previous AS certificate would be unable to connect to the enterprise network. The network configuration of _all_ those applicants would have to be reset or updated, which would only be possible with an out-of-band mechanism. Indeed, the management of key replacement in frameworks based on TOFU is an issue that is very difficult to address in a practical and scalable manner [19].