Devices and methods for client device authentication

A Wi-Fi Protected Access 2 Enterprise authenticator device comprising:

• a communications interface configured to:
• send to a client device a session identifier and a first challenge;
• and
• receive from the client device a username, a second challenge and a cryptographic hash for a first challenge, the second challenge, a session identifier and a passphrase;
• and
• at least one hardware processor configured to:
• verify if a valid stored primary passphrase or at least one valid stored secondary passphrase checks the cryptographic hash, each stored secondary passphrase valid during a limited defined period of validity or each stored secondary input corresponding to the primary input with at least one typing error;
• and
• in case a passphrase checks the cryptographic hash:
• send to the client device, via the communications interface, a message indicating successful authentication;
• and
• perform a handshake with the client device to adopt a key.

A computer program product which is stored on a non-transitory computer readable medium and comprises program code instructions executable by a processor to:

• send to the client device a session identifier and a first challenge;
• receive from the client device a username, a second challenge and a cryptographic hash for a first challenge, the second challenge, a session identifier and a passphrase;
• verify if a valid stored primary passphrase or at least one valid stored secondary passphrase checks the cryptographic hash, each stored secondary passphrase valid during a limited defined period of validity or each stored secondary input corresponding to the primary input with at least one typing error;
• and
• in case a passphrase checks the cryptographic hash:
• send to the client device a message indicating successful authentication;
• and
• perform a handshake with the client device to adopt a key.