Wep, Wpa Good

CH 4 Wireless Security
■ Wi-Fi security
■ WEP, WPA, WPA-2
■ Mobile device security
■ GSM & UMTS security
■ IEEE 802.11/11i
■ WLAN security
■ VPN security
Wireless LAN Security
Agenda
■ Brief background on Wireless LAN
■ Basic security mechanisms in 802.11
■ WEP Vulnerabilities
■ Enhancing wireless security with WPA
■ Comparing WEP and WPA
Brief Background
■ A local area network (LAN) with no
wires
■ Several Wireless LAN (WLAN) standards
802.11 - 1-2 Mbps speed, 2.4Ghz band
802.11b (Wi-Fi) – 11 Mbps speed, 2.4Ghz band
802.11a (Wi-Fi) - 54 Mbps speed, 5Ghz band
802.11g (Wi-Fi) – 54 Mbps speed, 2.4Ghz band
Wireless network components
Security Challenges and
Solutions
■ Challenges
Beyond any physical boundaries
Encryption, Authentication and Integrity
■ Basic Security Mechanisms in 802.11
Service Set ID (SSID, 32 bit) – Acts like a shared
secret, but sent in clear, same for all devices in a
WLAN.
MAC Address Lists – Modifiable and also sent in
clear.
The WEP Algorithm
WEP
WEP was designed to provide the same privacy that a user would
have on a wired network. WEP is based on the RC4 symmetric
encryption standard and uses either a 64-bit or 128-bit key.
WEP’s security issue actually begins here, because the entire
64- or 128-bit key is not used for encryption, and 24 bits of this
key are actually pealed off for use as an initialization vector (IV).
The purpose of the IV is to encrypt each packet with a different
key. This is accomplished by adding the IV to the 40-bit or
104-bit preshared key (PSK). The result is IV + PSK. This also
has reduced the effective key strength of the process because
the effective lengths of the keys are now only 40 or 104 bits.
PSK
There are two ways to generate and use
the PSK:
■ First, the default key method shares a
set of up to four default keys with all

the WAPs.
■ Second is the key-mapping method,
which sets up a key-mapping

relationship for each wireless station
with another individual station.
WEP
The big problem with WEP is that the IVs are not exclusive and are
reused. This results in a big vulnerability in that reused IVs
expose the PSK. To demonstrate this better, consider the
following. Let’s assume that our PSK is 8765309. This value
would be merged with qrs to create the secret key of
qrs8765309. This value would be used to encrypt a packet. The
next packet would require a new IV. Therefore it would still use
the PSK 8765309 but this time it would concatenate it with the
value mno to create a new secret key of mno8765309. This
would continue for each packet of data created.
This should help you realize the changing part of the secret key is
the IV, and that’s what WEP cracking is interested in. A busy AP
that sends a constant flow of traffic will actually use up all
possible IVs after five to six hours. Once someone can capture
enough packets so that he has reused keys, WEP can be
cracked.
Tools
such as WEP Crack and AirSnort were created for just this purpose.
More on WEP
■ Stands for Wired Equivalent Privacy
■ Designed to encrypt data over radio waves
■ Provides 3 critical pieces of security
Confidentiality (Encryption)
Authentication
Integrity
■ Uses RC4 encryption algorithm
Symmetric key stream cipher
64-bit shared RC4 keys, 40-bit WEP key, 24-bit
plaintext Initialization Vector (IV)
WEP Encryption and Integrity
Message
IV IV
Key
Seed PRNG Sequence XO Ciphert
R ext
Secret
Key
Integrit
CRC-32 y
Plainte Check
xt Algorithm
value
Plainte
xt
Data payload
PRNG – RC4 Pseudorandom number generation algorithm

Steps in WEP
1.The transmitting and receiving stations are initialized
with the secret key. This secret key must be
distributed by using an out-of-band mechanism such
as email, posting it on a web site, or giving it to you
on a piece of paper (as many hotels do).
2. The transmitting station produces a seed, which is
obtained by appending the 40-bit secret key to the
24-bit IV, for input into a pseudo-random number
generator (PRNG).
3. The transmitting station inputs the seed to the WEP
PRNG to generate a key stream of random bytes.
4. The key stream is XOR’d with plaintext to obtain the ciphertext.
5. The transmitting station appends the ciphertext to the IV and
sets a bit that indicates that it is a WEP-encrypted packet. This
completes WEP encapsulation, and the results are transmitted
as a frame of data. WEP encrypts only the data. The header and
trailer are sent in clear text.
6. The receiving station checks to see whether the encrypted bit of
the frame it received is set. If so, the receiving station extracts
the IV from the frame and appends the IV to the secret key.
7. The receiver generates a key stream that must match the
transmitting station’s key. This key stream is XOR’d with the
ciphertext to obtain the sent plaintext.
WEP Authentication
■ 2 levels of authentication
“Open” : No authentication
“Shared secret” :
Request for shared key auth.
Nonce N
Station B
Station A
E(N, KA-B)
Authentication response
WEP – The “flawed” Solution
■ Weakness in key management
Single key for all access points and client radios
Static unless manually changed
Authentication and encryption keys are the same
■ Shared key authentication failure
No knowledge of secret to gain network access
WEPPR=C ⊕ P (where C, P are passively recorded)
Authentication request
er
Attack
Challenge R P
WEPPR ⊕ R A
Success
(contd.)
■ Weakness in Encryption
Short 24-bit IV, reuse mandatory
Weak per-packet key derivation - exposes RC4
protocol to weak key attacks. Given c1 and c2 with
same IV, c1⊕ c2= p1⊕p2 [p1⊕ S ⊕ p2 ⊕ S], leading to
statistical attacks to recover plaintexts
Short 40-bit encryption scheme
■ No forgery protection
Using CRC-32 checksum possible to recompute
matching ICV for changed data bits
Given C= RC4(IV, key) ⊕ <M, ICV(M)>, can find C’
that decrypts to M’=M+Δ such that C’= RC4(IV,
key) ⊕ <M’, ICV(M’)>
(contd.)
■ No protection against replays
■ Optional, mostly not turned on by users
Design Constraints
■ WEP patches will rely entirely on
software upgrade
■ Access points have little spare CPU
capacity for new functions
■ Encryption functions are hard-wired in
the access points
Enhancing WLAN Security with
WPA
■ WPA - Wireless Protected Access
■ Strong, standards based, interoperable
security for Wi-Fi
■ Addresses all known weaknesses of WEP
■ Subset of forthcoming IEEE 802.11i standard
■ Designed to run as a software upgrade on
most Wi-Fi certified products.
Security Mechanisms in WPA -
TKIP
■ Uses TKIP (Temporal Key Integrity Protocol)
Encryption.
■ Suite of algorithms wrapping WEP
■ Adds 4 new algorithms to WEP:
1. New cryptographic message integrity code (MIC)
called Michael - to defeat forgeries
2. New IV sequencing discipline - to remove replay
attacks
3. A re-keying mechanism – to provide fresh
encryption and integrity keys
More on TKIP
4. A per-packet key mixing function

• Phase 1 (Eliminates same key use by all links) -
Combines MAC address and temporal key. Input to
S-box to produce intermediate key
• Phase 2 (De-correlates IVs and per-packet keys) -
Packet sequence number encrypted under the
intermediate key using a fiestel cipher to produce
128-bit per packet key.
■ TKIP leverages 802.1X/EAP framework for
key management
802.1X/EAP Architecture
Authenticatio
Supplicant Authenticat
n
(wireless or
Server
client) (AP)
(RADIUS)
EAP-start
EAP-identity request
EAP-identity response
EAP success/reject
EAP success/reject
WPA Modes of Operation -
Pre-shared key vs. Enterprise
■ Pre-shared Key Mode for home/SOHO users
Does not require authentication server
“Shared Secret” or password entered manually in
the AP and wireless client.
WPA takes over automatically.
Only the clients with matching passwords are
allowed to join the network.
The password automatically kicks off the TKIP
encryption process.
■ Enterprise Mode for corporate users
Requires an authentication server like RADIUS
Centralized management of user credentials
WPA modes of operation –
Enterprise Mode
Access Point
Interne
t
Wired Network Services
Authentication server
WEP vs. WPA
WEP WPA
Encryption Flawed Fixes all WEP flaws
40-bit keys 128-bit keys
Static-same keys Dynamic session keys.
used by everyone on Per-user, per-session,
network per-packet keys
Manual distribution Automatic Distribution
Authentication Flawed, uses WEP Strong user
key itself authentication using
802.1X and EAP
Comparing WPA and 802.11i
802.11i
802.1X
Key management WPA
Cipher & Authentication negotiation
TKIP
AES
Conclusion
■ WPA is not an ideal security protocol design…
■ However, it is a dramatic improvement in
Wi-Fi security.
■ Has not been broken (yet).
■ Protects the original hardware investment.
■ If hardware constraint removed, a more
robust security solution possible.
■ Such a solution is being developed based on
a even stronger cryptographic cipher -
Advanced Encryption Standard (AES).
References
[1] Bruce Potter & Bob Fleck, “802.11
Security”, O-Reilly, December 2002
[2]James larocca & Ruth larocca, “802.11
Demystified”, McGraw-Hill Telecom, 2002
[3]Whitepaper on Wireless LAN Security on
http://www.wi-fi.org
[4]http://www.ieee802.org/1/pages/802.1
x.html

Wep, Wpa Good

Uploaded by

Copyright:

Available Formats

Wep, Wpa Good

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Wep, Wpa Good

Uploaded by

Copyright:

Available Formats

CH 4 Wireless Security

set of up to four default keys with all

which sets up a key-mapping

PRNG – RC4 Pseudorandom number generation algorithm

Request for shared key auth.

4. A per-packet key mixing function

Wired Network Services

You might also like