Wireless Security.pdf - PDF Archive

Wireless LAN Security 425
WEP
WPA
(used with 802.1X)
Master-secret
(used by authentication
process; certificate;
password, etc.)
WPA
(used without 802.1X)
Master-secret
(User Password)
By-product of 802.1X-based
authentication process
Can be specified by network
administrator
Master-key
(Pre-shared/manually
configured)
40 bits/104 bits
PMK
(Pair-wise Master Key)
256 bits
PRF-512 (PMK, “Pair-wise Key Expansion”,
MACf || MAC2 || Noncef || Nonce2)
PTK (Pair-wise Transient Keys)
Prepend with IV
Data
Encryption-key
128 bits
Data
MIC-key
128 bits
EAPoL
Encryption-key
128 bits
EAPoL
MIC-key
128 bits
Phase-1 and phase-2
key mixing
Per-Packet-
Encryption-Key
Per-Packet-
Encryption-Key
Figure 18.8 : Key hierarchy in 802.11
As we saw, WPA is flexible about how the master key (PMK in WPA) is established. The
PMK, therefore, may be a preshared 16 secret key (WEP-design) or a key derived from an
authentication process like 802.1X. 17 WPA does require that the PMK be 256 bits (or 32
bytes) long. Since a 32-byte key is too long for humans to remember, 802.11 deployments
16
As we saw, this usually means that the keys are manually configured.
17
It is expected that most enterprise deployments of 802.11 would use 802.1X while the preshared
secret key method (read manual configuration) would be used by residential users.
www.newnespress.com