Wireless Security WPA

1
Wireless Security
WPA WPA2
By Jing QinCSC650 Internet SecurityInstructor
Stan Osborne
2
What is WPA WPA2 - Wi-Fi Protected Access

• WPA was created by The Wi-Fi Alliance in late
  2002.
• WPA implements a subset of IEEE 802.11i
  standard
• WPA2 implements a full IEEE 802.11i standard
• They solved all of WEPs known vulnerabilities.

3
Wired Equivalent Privacy ( WEP )
Encryption Algorithm of WEP

• WEP uses a 40-bit static shared key.
• Message packet uses the RC4 encryption algorithm,
  a stream cipher.
• WEP includes a 24 bits Initialization Vector (IV)
  in each message packet.
• RC4 key of a packet WEP Key IV
• 64 bit
  40 bit 24 bit

4
Some Serious Weaknesses of WEP

• All clients network cards and APs share a single,
  static WEP Key.
• Lack of automated key management contributes to
  infinite static key lifespan in large networks.
• The 24 bit IV is too small - every 4096 packets,
  two will share the same IV.
• Keys can be recovered with easily available
  utilities
• Weak keys expose the network to attacks or
  passive
• monitoring
• When WEP was available it was not always turned
  on

5
Wi-Fi Protected Access (WPA)

• WPA is intended to be
• Interim short-term replacement for WEP
• A software/firmware upgrade to existing
  access
• points.
• Inexpensive in terms of time and cost to
  implement.
• Suitable for enterprise, small sites,
  home networks.

6
Two modes of WPA

• Enterprise Mode (WPA)
• Requires an authentication server
• Uses RADIUS protocols for authentication and
  key distribution
• Centralizes management of user credentials
• Pre-Shared Key Mode (WPA-PSK)
• Does not require authentication server
• Shared Secret (passphrase) is used for
  authentication to access point

7
How WPA Addresses the WEP Vulnerabilities

• WPA wraps RC4 cipher engine in four new
  algorithms
• Extends to 128 bit WEP Key.
• Extends to 48-bit IV and add IV Sequencing Rules
• 3. Temporal Key Integrity Protocol (TKIP)
  generates and dynamically changes per-packet
  keys.
• 4. A Message Integrity Code (MIC) - Michael

8
Wi-Fi Protected Access 2 (WPA2)

• Uses the Advanced Encryption Standard (AES)
• AES selected by National Institute of
  Standards and
• Technology (NIST) as replacement for DES
• Symmetric-key block cipher using 128-bit
  keys
• Generates CCM Protocol (CCMP) - Cipher Block
  Chaining Message Authentication Code Protocol)
• CCMP CTR CBC MAC
• Hardware accelerated and will require replacement
  of most APs.
• Certified equipment due in late 2004

Cipher Block Chaining/ Message Authentication
Code
Counter Mode Encryption
9
Encryption Method Comparison
Extensible Authentication Protocol
10
Conclusions

• WPA resolves all of WEPs known weaknesses
• WPA provides an enterprise-class security
  solution for user authentication and encryption
• WPA is a subset of the 802.11i draft standard and
  is expected to maintain forward compatibility
  with the standard
• WPA 2 will provide an even stronger cryptographic
  cipher than WPA
• Unless there is a significant flaw found in WPA
  or RC4 is broken, there may be no reason to move
  to WPA 2/AES in the near future