|
IEEE 802.11i, is an amendment to the 802.11 standard specifying security mechanisms for wireless networks (see Wi-Fi). The draft standard was ratified on 24 June 2004, and supersedes the previous security specification, Wired Equivalent Privacy (WEP), which was shown to have severe security weaknesses. Wi-Fi Protected Access (WPA) had previously been introduced by the Wi-Fi Alliance as an intermediate solution to WEP insecurities. WPA implemented a subset of 802.11i. The Wi-Fi Alliance refers to their approved, interoperable implementation of the full 802.11i as WPA2, also called RSN (Robust Security Network). 802.11i makes use of the Advanced Encryption Standard (AES) block cipher, whereas WEP and WPA use the RC4 stream cipher. IEEE 802. ...
The notebook is connected to the wireless access point using a PC card wireless card. ...
Official Wi-Fi logo Wi-Fi was originally a brand licensed by the Wi-Fi Alliance to describe the embedded technology of wireless local area networks (WLAN) based on the IEEE 802. ...
June 24 is the 175th day of the year (176th in leap years) in the Gregorian calendar, with 190 days remaining. ...
shelby was here 2004 (MMIV) was a leap year starting on Thursday of the Gregorian calendar. ...
Wired Equivalent Privacy or Wireless Encryption Protocol (WEP) is a scheme to secure IEEE 802. ...
Wi-Fi Protected Access (WPA and WPA2) is a class of systems to secure wireless (Wi-Fi) computer networks. ...
Official Wi-Fi logo The Wi-Fi Alliance is a trade group that owns the trademark to Wi-Fi. ...
Another element of the 802. ...
In cryptography, the Advanced Encryption Standard (AES), also known as Rijndael, is a block cipher adopted as an encryption standard by the U.S. government. ...
Encryption Decryption In cryptography, a block cipher is a symmetric key cipher which operates on fixed-length groups of bits, termed blocks, with an unvarying transformation. ...
For the Vietnam road named RC4, see Route Coloniale 4. ...
The operation of A5/1, a LFSR-based stream cipher used to encrypt mobile phone conversations. ...
The 802.11i architecture contains the following components: 802.1X for authentication (entailing the use of EAP and an authentication server), RSN for keeping track of associations, and AES-based CCMP to provide confidentiality, integrity and origin authentication. Another important element of the authentication process is the four-way handshake, explained below. IEEE 802. ...
Extensible Authentication Protocol, or EAP, is a universal authentication framework frequently used in wireless networks and Point-to-Point connections. ...
This article needs to be wikified. ...
Another element of the 802. ...
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is an IEEE 802. ...
Confidentiality has been defined by the International Organization for Standardization (ISO) as ensuring that information is accessible only to those authorized to have access and is one of the cornerstones of Information security. ...
In computer science and telecommunications, the term data integrity has the following meanings: The condition in which data is identically maintained during any operation, such as transfer, storage, and retrieval. ...
Authentication (from Greek αυθεντικός; real or genuine, from authentes; author) is the act of establishing or confirming something (or someone) as authentic, that is, that claims made by or about the thing are true. ...
Encryption key distribution
The Four-Way Handshake The authentication process leaves two considerations: the access point (AP) still needs to authenticate itself to the client station (STA), and keys to encrypt the traffic need to be derived. The earlier EAP exchange has provided the shared secret key PMK (Pairwise Master Key). This key is however designed to last the entire session and should be exposed as little as possible. Therefore the four-way handshake is used to establish another key called the PTK (Pairwise Transient Key). The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address and STA MAC address. The product is then put through a cryptographic hash function. A wireless access point (WAP or AP) is a device that connects wireless communication devices together to create a wireless network. ...
A key is a piece of information that controls the operation of a cryptography algorithm. ...
Extensible Authentication Protocol, or EAP, is a universal authentication framework frequently used in wireless networks and Point-to-Point connections. ...
In security engineering, a nonce is a number used once. ...
In computer networking a Media Access Control address (MAC address) or hardware address or adapter address is a quasi-unique identifier attached to most network adapters (NICs). ...
In cryptography, a cryptographic hash function is a hash function with certain additional security properties to make it suitable for use as a primitive in various information security applications, such as authentication and message integrity. ...
The handshake also yields the GTK (Group Temporal Key), used to decrypt multicast and broadcast traffic. The actual messages exchanged during the handshake are depicted in the figure and explained below:
- The AP sends a nonce-value to the STA (ANonce). The client now has all the attributes to construct the PTK.
- The STA sends its own nonce-value (SNonce) to the AP together with a MIC.
- The AP sends the GTK and a sequence number together with another MIC. The sequence number is the sequence number that will be used in the next multicast or broadcast frame, so that the receiving STA can perform basic replay detection.
- The STA sends a confirmation to the AP.
As soon as the PTK is obtained it is divided into five separate keys: Image File history File links No higher resolution available. ...
A wireless access point (WAP or AP) is a device that connects wireless communication devices together to create a wireless network. ...
In wireless communications the term Message Integrity Code or MIC is used to refer to a cryptographic checksum used in the handshaking process. ...
PTK (Pairwise Transient Key – 64 bytes)
- 16 bytes of EAPOL-Key Encryption Key (KEK) - AP uses this key to encrypt additional data sent (in the 'Key Data' field) to the client (for example, the RSN IE or the GTK)
- 16 bytes of EAPOL-Key Confirmation Key (KCK)– Used to compute MIC on WPA EAPOL Key message
- 16 bytes of Temporal Key (TK) – Used to encrypt/decrypt Unicast data packets
- 8 bytes of Michael MIC Authenticator Tx Key – Used to compute MIC on unicast data packets transmitted by the AP
- 8 bytes of Michael MIC Authenticator Rx Key – Used to compute MIC on unicast data packets transmitted by the station
The Michael MIC Authenticator Tx/Rx Keys provided in the handshake are only used if the network is using TKIP to encrypt the data.
The Group Key Handshake The GTK used in the network may need to be updated due to the expiry of a preset timer. When a device leaves the network, the GTK also needs to be updated. This is to prevent the device from receiving any more multicast or broadcast messages from the AP.
To handle the updating, 802.11i defines a Group Key Handshake that consists of a two-way handshake:
- The AP sends the new GTK to each STA in the network. The GTK is encrypted using the KEK assigned to that STA and protects the data from being tampered using a MIC.
- The STA acknowledges the new GTK and replies to the AP.
GTK ( Groupwise Transient Key – 32 bytes) - 16 bytes of Group Temporal Encryption Key – Used to encrypt Multicast data packets
- 8 bytes of Michael MIC Authenticator Tx Key – Used to compute MIC on Multicast packet transmitted by AP
- 8 bytes of Michael MIC Authenticator Rx Key – This is currently not used as stations do not send multicast traffic
The Michael MIC Authenticator Tx/Rx Keys provided in the handshake are only used if the network is using TKIP to encrypt the data.
Devices implementing 802.11i In general, the use of WPA2 needs firmware or driver support of both devices, the wireless host (router or access point) and the wireless client (adapter).
Usually, the wireless host can be enabled to support WPA2 by a firmware upgrade, available at the manufacturer's site. The client needs an update of the wireless adapter driver, and maybe part of the operating system as well.
With the release of the 4.2 update to their AirPort software, Apple now supports WPA2 on all AirPort Extreme-enabled Macintoshes, the AirPort Extreme Base Station, and the AirPort Express (firmware upgrades included in AirPort 4.2). Mac OS X (official IPA pronunciation: ) is a line of proprietary, graphical operating systems developed, marketed, and sold by Apple Inc. ...
Apple Inc. ...
Airport Extreme is a Wireless Solution used on the Apple Macintosh platorm. ...
Airport Express can refer to the following: AirPort Express, Apple Computers wireless product Airport Express (MTR), the airport railway service in Hong Kong provided by MTR Airport Express (Sydney), a former bus to Sydney Airport, replaced by the extension of the Airport and East Hills railway line AREX...
Support of WPA2 needs an operating system update (KB917021 (Replaces KB893357), see external link below), and upgrade of wireless adapter drivers. There is a link to Intel drivers below. WPA2 support for Windows XP x64 is included in Windows XP x64 SP2.[1] Windows XP is a line of operating systems developed by Microsoft for use on general-purpose computer systems, including home and business desktops, notebook computers, and media centers. ...
All RTM editions of Windows Vista support WPA2 without any additional patches. Windows Vista is a line of graphical operating systems used on personal computers, including home and business desktops, notebook computers, Tablet PCs, and media centers. ...
Support of WPA2 is available. Drivers are needed to support WPA as well as the userspace utility, wpa_supplicant or Xsupplicant. Linux (IPA pronunciation: ) is a Unix-like computer operating system. ...
wpa_supplicant is a free software implementation of 802. ...
Xsupplicant allows a workstation to authenticate with a RADIUS server using 802. ...
A tool called NetworkManager, with GNOME and KDE frontends can be used to configure access to protected wireless networks. NetworkManager is a software utility aimed at simplifying the use of computer networks on Linux and other Unix-like operating systems. ...
This article needs additional references or sources for verification. ...
KDE (K Desktop Environment) (IPA: ) is a free software project which aims to be a powerful system for an easy-to-use desktop environment. ...
Support of WPA2 is available on the S60 Platform for mobile phones that use Symbian OS v.9.1 or later[citation needed]. An example of such a device is the Nokia E70. Symbian OS is a proprietary operating system, designed for mobile devices, with associated libraries, user interface frameworks and reference implementations of common tools, produced by Symbian Ltd. ...
The S60 Platform (formerly Series 60 User Interface) is a platform for mobile phones that uses Symbian OS. S60 is currently amongst the leading smartphone platforms in the world. ...
The Nokia E70 is a candybar/fold keyboard type smartphone from the Eseries range, announced in October 2005 and released in May 2006 at a cost of approximately $500 with prices in July 2007 around $345. ...
See also WAPI (WLAN Authentication and Privacy Infrastructure) is a Chinese National Standard for Wireless LAN (GB 15629. ...
In cryptography, TKIP (Temporal Key Integrity Protocol) is a security protocol used in Wi-Fi Protected Access (WPA). ...
CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is an IEEE 802. ...
Wi-Fi Protected Setup (WPS) is a standard for easy and secure establishment of a wireless home network, created by the Wi-Fi Alliance and officially launched on January 8, 2007. ...
External links NIST logo The National Institute of Standards and Technology (NIST, formerly known as The National Bureau of Standards) is a non-regulatory agency of the United States Department of Commerce’s Technology Administration. ...
References - ^ Windows Server Division WebLog : Windows Server 2003 and XP x64 Editions Service Pack 2
| 
Feeds |
Contact