Wireless Security.pdf - PDF Archive

Wireless LAN Security 409
authenticating the station to join the network 4 if it has been configured to accept OSA as a
valid authentication scheme. In other words, the AP does not do any checks on the identity of
the station and allows any and all stations to join the network. OSA is exactly what its name
suggests: open system authentication. The AP (network) allows any station (that wishes to
join) to join the network. Using OSA therefore means using no authentication at all.
It is important to note here that the AP can enforce the use of authentication. If a station
sends an authentication request requesting to use OSA, the AP may deny the station
access to the network if the AP is configured to enforce SKA on all stations.
18.4.2 Shared Key Authentication
Shared Key Authentication (SKA) is based on the challenge-response system. SKA
divides stations into two groups. Group One consists of stations that are allowed access
to the network and Group Two consists of all other stations. Stations in Group One share
a secret key which stations in Group Two don’t know. By using SKA, we can ensure that
only stations belonging to Group One are allowed to join the network.
Using SKA requires (1) that the station and the AP be capable of using WEP and (2)
that the station and the AP have a preshared key. The second requirement means that a
shared key must be distributed to all stations that are allowed to join the network before
attempting authentication. How this is done is not specified in the 802.11 standard.
Figure 18.3 explains how SKA works in detail.
When a station wants to join a network, it sends an authentication request to the
appropriate AP which contains the authentication algorithm it wishes to use (1 in case
of SKA). On receiving this request, the AP sends an authentication response back to the
station. This authentication response contains a challenge-text. The challenge text is a
128-byte number generated by the pseudorandom-number-generator (also used in WEP)
using the preshared secret key and a random Initialization Vector (IV). When the station
receives this random number (the challenge), it encrypts the random number using WEP 5
and its own IV to generate a response to the challenge. Note that the IV that the station
uses for encrypting the challenge is different from (and independent of) the IV that the
4
The authentication request from the station may be denied by the AP for reasons other than
authentication failure, in which case the status field will be nonzero.
5
WEP is described in Section 18.5.
www.newnespress.com