wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

28-4 Industrial Communication Systems
CRC
generation
algorithm
Payload
Packet
CRC
RC4
algorithm
Per packet
key
Concatenate
IV and key
IV
Generation
algorithm
Wireless station
Payload
Keystream
24 bits
Plaintext input
XOR
Payload bits
XOR with
keystream
Shared
key
Ciphertext
Radio
interface
XOR
Keystream
Plaintext
output
Initialization
vector
RC4
algorithm
Concatenate
IV and key
CRC
Per packet
key
Access point
Packet
Shared
key
Payload
FIGURE 28.3
RC4 encryption/decryption process.
The basic insecurities of RC4 are
• Pseudorandom IV
• Exclusive OR based
• Weak keys
• Keystream reuse
WEP has been cryptographically broken due to its reuse of IVs. If the attacker can capture enough
data, the attacker can decrypt the encrypted data without ever learning the encryption key. There are
a variety of WEP cracking tools freely available on the Internet, which include, but are not limited to,
AirSnort, Wepcrack, WepAttack, and Asleap-imp [4].
28.2.2.2 WiFi Protected Access
WiFi protected access (WPA) is a security standard based on IEEE 802.11i draft 3 with early TKIP implementations.
The main design goal of WPA was to make this protocol WEP compatible but more secure
and to coordinate vendor solutions for WEP flaws. WPA corrects the problems with WEP by using a
larger key length and improving the handling of IVs. WPA distributes different keys to different users
with an IEEE 802.1X authentication server. A 48 bit IV and a 128 bit key are used with RC4 encryption.
The main elements of WPA are TKIP, message integrity code to ensure that messages are not tampered
with, and the IEEE 802.1X authentication framework. 802.1X defines how to authenticate wired/wireless
clients using authentication mechanisms such as RADIUS or EAP. RADIUS (remote authentication dialin-user
services) is a protocol used to authenticate dial-in users. EAP (extensible authentication protocol)
is a framework authentication protocol used by 802.1X to provide network authentication. One of the
flaws of WPA is pre-shared key (PSK), which allows the administrator to specify a password that must be
known by all users for access to the AP. An offline dictionary attack can be used to recover the PSK if the
password used is not sufficiently long [9].
© 2011 by Taylor and Francis Group, LLC