# Understanding Server Authentication in WPA3 Enterprise
## 4 Examples  
For the purpose of our discussion, the behavior of a supplement may be described in a state machine-like fashion by means of the following variables whose names and values are self-explanatory:  
* Connected: a boolean. * TOD-Policy: an enumerated value in none, TOD-TOFU, TOD-STRICT. * AS-name: either none or a name for an Authorization Server. Initially, for a given SSID, a supplement is disconnected and both TOD-Policy and AS-name are set to none. Rather than analyzing all possible transitions from the initial state, we analyze the three key scenarios separately: first, we analyze the supplement behavior in a network with no TOD policy, then in a network with a TOD-TOFU policy, and finally in a network with a TOD-STRICT policy. Furthermore, in order to simplify the description, we consider only a subset of the possible state transitions and outline other possible evolutions later. Supplicant evolution in a network with no TOD policy is represented in Figure 1. We use a graphical notation in which a state is represented by a box containing the values for variables TOD-Policy and AS-name; the value of variable Connected is represented implicitly, with either a dashed box (disconnected supplicant) or a continuous box (connected supplicant). State transitions are represented by arrows. The text close to each arrow summarizes the event that provoked the transition. Such an event may be either an execution of Phase 1, or a disconnection, or a change in the supplicant configuration executed by means of an out-of-band procedure. Upon the first connection attempt (transition \"a\"), the user decides whether to trust the certificate received from the AS and, if so, further connections with that AS will occur automatically (transition \"b\"; the value last-AS for variable AS indicates the name of the AS in the last accepted certificate). If the AS identity declared in Phase 1 changes, the user will be involved again (transition \"c\"). that even if the AS identity declared in Phase 1 changes, the supplement will stick to the AS identity learnt upon the first connection (transition \"a\"). While in this state, the only means for entering Phase 2 with a different AS requires changing the supplement configuration with an out-of-band mechanism--e.g., by resetting the supplicant in its initial state. Such an event would correspond to a state transition not indicated in Figure 2.  
Finally, evolution in a network with a TOD-STRICT policy is represented in Figure 3. In this case, the user is never involved and the supplicant will only connect to the AS whose identity has been configured out-of-band. Figure 2: Supplicant evolution in a network with a TOD-TOFU policy. In order to keep the presentation more focused, these diagrams illustrate only a subset of the supplicant evolutions allowed by the specification. Some of the evolutions not represented by the diagrams may result from the following facts. * A supplicant could observe different values for the TOD-policy along its lifetime. For example, in Figure 1, when the supplicant is disconnected (state \"d\"), it could receive a certificate with a TOD policy set to either TOD-TOFU or TOD-STRICT and complete Phase 1 successfully. In these cases, the supplicant would update its variables accordingly, leading to states not shown in the figure. Similar considerations apply to Figure 2.
* The variables of a supplement could be modified with out-of-band mechanisms. WPA3 Enterprise does not specify any requirements regarding how or when such modifications occur. For example, a supplicant could be reset in its initial state or its TOD policy could be modified, leading to states not shown. An extremely important supplicant evolution not shown in the diagrams but allowed by the specification is that, in Figure 3, a supplicant in the initial state could change state even _without_ installing the network profile required by the organization.