Wi-Fi roaming security practices for access network providers and identity providers

This report summarizes Wireless Broadband Alliance guidance for securing Passpoint/OpenRoaming Wi‑Fi roaming: recommended EAP authentication methods (EAP‑TLS, EAP‑TTLS, EAP‑SIM/AKA), identity privacy practices for NAIs and Chargeable‑User‑Identity, encryption guidance (WPA2/WPA3, risks from transition mode), secure backhaul and RADIUS transport options (RADIUS/TLS, RADIUS/DTLS, VPN fallback), physical access point protections, and planning for post‑quantum cryptography. It is normative guidance for operators rather than a description of an incident or exploit.