Wireless Security.pdf - PDF Archive

412 Chapter 18
channel scanning/probing time. This re-authentication delay becomes even more of a
bottleneck for real time applications like voice. Although this is not exactly a security
loophole, it is a “ drawback ” of using the security.
18.4.4 What’s Wrong with 802.11 Authentication?
Authentication mechanisms suggested by 802.11 suffer from many drawbacks. As we
saw, 802.11 specifies two modes of authentication—OSA and SKA. OSA provides no
authentication and is irrelevant here.
SKA works on a challenge-response system as explained in Section 18.4.2. The AP
expects that the challenge it sends to the STA be encrypted using an IV and the preshared
key. As described in Section 18.2.1, there is no method specified in WEP for each STA to
be assigned a unique key. Instead all STAs and the AP in a BSS are configured with the
same key. This means that even when an AP authenticates a STA using the SKA mode,
all it ensures is that the STA belongs to a group of STAs which know the preshared key.
There is no way for the AP to reliably determine the exact identity of the STA that is
trying to authenticate to the network and access it. 8
To make matters worse, many 802.11 deployments share keys across APs. This increases
the size of the group to which a STA can be traced. All STAs sharing a single preshared
secret key also makes it very difficult to remove a STA from the allowed set of STAs,
since this would involve changing (and redistributing) the shared secret key to all
stations.
There is another issue with 802.11 authentication: it is one-way. Even though it provides
a mechanism for the AP to authenticate the STA, it has no provision for the STA to
be able to authenticate the network. This means that a rogue AP may be able to hijack
the STA by establishing a session with it. This is a very plausible scenario given the
plummeting cost of APs. Since the STA can never find out that it is communicating with a
rogue AP, the rogue AP has access to virtually everything that the STA sends to it.
Finally, SKA is based on WEP, discussed in Section 18.5. It therefore suffers from all the
drawbacks that WEP suffers from too. These drawbacks are discussed in Section 18.5.1.
8
MAC addresses can be used for this purpose but they are not cryptographically protected in that it
is easy to spoof a MAC address.
www.newnespress.com