Lappeenranta University of TechnologyFaculty of Technology ManagementLaboratory of Communications SoftwareCT30A8800 Secured Communications

802.11 security protocolsSeminar report

Marko IhonenAnssi SaloTuomo Timonen

ii

ABSTRACT

Lappeenranta University of TechnologyFaculty of Technology ManagementLaboratory of Communications SoftwareCT30A8800 Secured Communications

Marko IhonenAnssi SaloTuomo Timonen

802.11 security protocolsSeminar work2009

32 pages, 7 figures, 3 tables and 4 appendices.

Examiners: D.Sc. (Tech.) Pekka Jäppinen, M.Sc (Tech.) Were Oyomno

Keywords: WPA2, IEEE 802.11i, IEEE 802.11X, WEP, WPA, TKIP, CCMP, WLAN security

Wireless communication medium is, by its nature, vulnerable to variety of different threats,including unauthorized access, eavesdropping of communication, modification andrepetition of data, denial of service, and fabrication of data. Therefore, it’s essential that thesecurity protocol can counter to these issues. In this seminar report, we introduce threecommonly used WLAN security protocols that try to provide protection against thesethreats: WEP, WPA and WPA2.

We start by introducing the Wired Equivalent Protocol (WEP) and continue to the generalauthentication framework used by IEEE 802.11i security amendment: IEEE 802.1X andExtensible Authentication Protocol. Moreover, different key management schemes arediscussed under this topic. Finally, we go through the data encryption protocols used inWPA and WPA2 that are TKIP and CCMP respectively.

Since, WLANs are so widely used, we feel that it’s important to understand thefunctionality of different wireless security protocols. The goal is that after reading thispaper, the reader gains a detailed view of the topic.

1

TABLE OF CONTENTS

ABBREVIATIONS............................................................................................................2

1 INTRODUCTION ......................................................................................................4

2 WIRED EQUIVALENT PRIVACY ...........................................................................5

3 IEEE 802.11i ..............................................................................................................8

4 AUTHENTICATION AND KEY MANAGEMENT ..................................................9

4.1 Key generation..................................................................................................10

4.1.1 Master Session Key ...................................................................................11

4.1.2 The 4-Way Handshake ..............................................................................12

4.2 EAP (Enterprise mode) .....................................................................................14

4.2.1 EAP-Message Digest 5..............................................................................15

4.2.2 EAP- Transport Layer Security..................................................................15

4.2.3 EAP-Tunneled Transport Layer Security ...................................................16

4.2.4 EAP-SIM ..................................................................................................16

5 Wi-Fi Protected Access.............................................................................................18

6 Wi-Fi Protected Access 2..........................................................................................21

7 CONCLUSIONS ......................................................................................................26

REFERENCES.................................................................................................................27

APPENDICES..................................................................................................................29

Appendix A: 802.11 MAC frame format.......................................................................29

Appendix B: Payload of 802.11 frame with WEP encryption. .......................................29

Appendix C: TKIP MPDU............................................................................................30

Appendix D: CCMP MPDU .........................................................................................30

2

ABBREVIATIONS

AES Advanced Encryption Standard

AP Access Point

CBC-MAC Chaining-Message Authentication Code Message

Authentication Code

CCMP Counter Mode with Cipher Block Chaining Message

Authentication Code Protocol

CRC Cyclic Redundancy Check

CTR Counter Mode

DA Destination Address

DES Data Encryption Standard

EAP Extensible Authentication Protocol

EAP-TLS EAP-Transport Layer Security

EAP-TTLS EAP-Tunneled Transport Layer Security

EAP-SIM EAP for GSM Subscriber Identity

EAPOL EAP Over Local Area Network

FCS Frame Check Sequence

GSM Global System for Mobile Communications

GTK Group Transient Key

ICV Integrity Check Value

IEEE Institute of Electrical and Electronics Engineers

IV Initialization Vector

KCK EAPOL-Key confirmation key

KEK EAPOL-Key encryption key

MAC Medium Access Control

MD5 Message-Digest Algorithm

MIC Message Integrity Code

MPDU Media Access Control Protocol Data Unit

MSB Most Significant Bit

MSDU Media Access Control Service Data Unit

3

MSK Master Session Key

NIST National Institute of Standards and Technology

PAE Port Access Entity

PDU Protocol Data Unit

PKI Public Key Infrastructure

PMK Pair-wise Master Key

PN Packet Number

PRNG Pseudo-Random Number Generator

PSK Pre-Shared Key

PTK Pair-wise Transient Key

QoS Quality of Service

RADIUS Remote Authentication Dial In User Service

RC4 Rivest Cipher 4

SA Source Address

SIM Subscriber Identity Module

SSL Secure Socket Layer

SSID Service Set Identifier

TA Transmitter Address

TKIP Temporal Key Integrity Protocol

TLS Transport Layer Security

TTLS Tunneled Transport Layer Security

TSC TKIP Sequence Counter

WEP Wired Equivalent Privacy

WLAN Wireless Local Area Network

WPA Wi-Fi protected access

XOR Exclusive OR

4

1 INTRODUCTION

Over the past years, the volume of Wireless Local Area Network (WLAN, IEEE Std.

802.11) capable devices has been constantly increasing, providing connectivity to the

Internet and local networks. Wireless networks can be used, for example, to reduce cabling

costs by solving the last step problem between an access point (AP) and terminal device.

Furthermore, it speeds up the deployment of the network and provides an enhanced support

for mobility. However, if this wireless communication channel is used to transmit sensitive

data in business, industry or home, then the communication channel should be secure to

prevent illegal activities.

Wireless communication medium is, by its nature, vulnerable to variety of threats,

including unauthorized access, eavesdropping of communication, modification and

repetition of data, denial of service, and fabrication of data. Therefore, a security protocol

that provides effective authentication, authorization, data encryption and means for

handling modification and repetition of data is essential. Since, WLANs are so widely

used, we feel that it’s important to understand the functionality of different wireless

security protocols. This paper discusses Wired Equivalent Privacy (WEP), Wi-Fi Protected

Access (WPA) and Wi-Fi Protected Access 2 (WPA2) with details and pinpoints their main

weaknesses and benefits. The following research questions were set: What security

primitives or algorithms different WLAN security protocols use? How wireless

communication channel is secured with different protocols? How authentication is

handled? How data is encrypted? What are the benefits and vulnerabilities of each

protocol?

Chapter 2 introduces WEP, which is the first protocol for securing WLAN communication.

Chapter 3 presents a short briefing to the IEEE 802.11i standard, from which WPA and

WPA2 have been developed. In chapter 4, we describe the IEEE 802.1X standard, which

provides an authentication framework for 802.11i. Then, chapters 5 and 6 present the

functionalities of WPA and WPA2 with details. Finally, conclusions are drawn in chapter

7.

5

2 WIRED EQUIVALENT PRIVACY

WEP is an optional security mechanism for WLANs that was introduced in the IEEE

802.11-1997 standard, trying to provide a security level that is comparable to traditional

wired networks [802.11-2007]. In practice, WEP provides WLAN security through simple

authorization and data encryption. These are now shortly described in order to pinpoint

their weaknesses.

WEP uses the Rivest Cipher 4 (RC4) stream cipher as an encryption and decryption

algorithm. RC4 uses a pseudo-random number generator (PRGN) to generate a bit stream

(also known as a key stream) from a WEP seed, which is a concatenation of 24-bit

initialization vector (IV) and 40-bit key. However, it should be noted that the WEP

algorithm can make use of 104-bit keys as stated in the IEEE standard [802.11-2007].

Ciphertext is created by XORing the generated key stream with plaintext and its integrity

check value (ICV), which is calculated by using CRC-32 algorithm. ICV is used to protect

ciphertext against unauthorized modifications and acts like a fingerprint for each message.

Finally, the WEP algorithm concatenates the encrypted ciphertext with current IV, which is

needed for decrypting the message. This results in a complete WEP frame that can be sent

over the used communication channel [802.11-2007]. Refer to appendix b to check the

structure of the frame payload field. WEP encryption process is depicted in the figure 1.

Figure 1: A block diagram of WEP encryption [802.11-2007]

6

The decryption process is done in reverse order. Firstly, the receiver separates the

unencrypted IV from WEP frame and generates the correct key stream. It is required that

both participants know the encryption key. Secondly, the receiver decrypts the message by

using XOR function and calculates a new ICV value for the plaintext and compares it to the

one received in order to validate data integrity [802.11-2007].

Generally speaking, WEP supports two types of legacy authentication methods: open

system authentication and shared key authentication [Sarmi2008]. In open system

authentication, every device can access the network. In shared key authentication, terminal

device and access point share a common key, which is verified every time a client tries to

connect to the network. This is done by applying a challenge-response procedure and

therefore WEP encryption must be enabled. AP sends a challenge to the connecting client,

which encrypts the message and responses accordingly. Then, AP verifies and checks if the

message was encrypted correctly and accepts/denies the connection request [Sarmi2008].

Nowadays, WEP can be considered as an obsolete protocol, because it doesn’t provide an

acceptable level of security. First of all, in many of the shared key implementations, the

same key is used throughout the network disabling unique authentication. Therefore, every

malicious entity that can gain access to the shared key can connect to the network. The

standard does not provide any means of distributing the keys automatically and thus forces

to manual distribution, which can be problematic with a large user-base. This also raises

the question of how the keys need to be stored so that they won’t fall into the wrong hands.

In addition, the CRC-32 algorithm, which is used by WEP to generate the ICV, is

cryptographically insecure because of its linearity. This means that the algorithm generates

a similar signature for similar messages without any use of any use of initialization values

and/or keys, and thus makes it possible to modify data without breaking the checksum

[Moen2004].

RC4 algorithm itself isn’t the security bottleneck of WEP, since many security protocols

using it, such as Secure Socket Layer (SSL) and Transport Layer Security (TLS), can be

considered secure [Sarmi2008]. The problem is the WEPs` way of using it [Bulbul2008]:

• The use of shared key directly to data encryption.

7

• Lack of key management.

• Short keys (40 bits).

• Short IVs (24 bits): results in an inevitable reuse of keys and since they are

concatenated unencrypted to the WEP frame, it’s possible to eavesdrop the

communication and deduct the shared key.

• Authentication forging: Poor implementation of the shared key authentication

mechanism makes it less secure than open system authentication. An intruder can

eavesdrop a successful challenge-response procedure and forge an authentication by

determining the used key stream [Bulbul2008].

8

3 IEEE 802.11i

In order to develop the security of 802.11 and react to the several weaknesses of WEP,

802.11i workgroup composed an amendment [802.11i-2004] to the original 802.11

standard that specifies various security mechanisms for wireless networks. The

enhancement was later accepted and incorporated to the current 802.11-2007 standard

[802.11-2007]. It offers the following components to overcome the main weaknesses of

WEP:

• Improved authentication with IEEE 802.1X standard and Extensible Authentication

Protocol (EAP).

• Key management: The master key is not used directly in data encryption, but rather

a temporary key is used.

• Enhanced data integrity and confidentiality through the use of Temporal Key

Integrity Protocol (TKIP) or Counter Mode with Cipher Block Chaining Message

Authentication Code Protocol (CCMP).

• Stronger initialization vectors (48 bits) and encryption keys (128 bits).

Wi-Fi Protected Access was developed by the Wi-Fi alliance as an intermediate solution,

since it does not implement the whole security framework of 802.11i. The main design

principle was to ensure backwards compatibility with older WEP capable devices and to

overcome all known security flaws in WEP [Moen2004]. At best, a firmware upgrade was

only required for older devices. WPA applies TKIP to provide unique frame-keys for each

frame, but the encryption process itself is similar to WEP.

Wi-Fi Protected Access 2 is an enhancement to WPA and fully implements the security

mechanisms of 802.11i. Both WPA and WPA2 apply 802.1X framework to handle the

authentication, but the main difference between them is within the data encryption. WPA2

introduces a new encryption protocol called CCMP, which is based on Advanced

Encryption Standard (AES).

9

4 AUTHENTICATION AND KEY MANAGEMENT

Authentication and authorization play an important role in WLAN security. The purpose is

to identify connecting user or device (authentication) and decide whether network access is

allowed for that entity (authorization) [Dantu2007]. Throughout this document the

following notation is used to describe entities involved in the authentication procedure:

• The supplicant: A device requesting access to the network. For example, a laptop

computer.

• The authenticator: A device (for example, a WLAN access point) with whom the

supplicant authenticates itself in order to gain access to the network.

• The authentication server: Can be either an external or internal server, which

processes the authentication requests and grants authentication for the supplicant

via authenticator.

Generally speaking, IEEE 802.11i specifies two different authentication modes: one for

small office and personal networks called personal mode and one for larger networks and

enterprises called enterprise mode. In personal mode, there is a shared secret (Pre-Shared

Key, PSK) between the authenticator and supplicants, and therefore no need for

authentication server. In enterprise mode, authentication is handled through IEEE 802.1X

standard and Extensible Authentication Protocol that provide a general purpose

authentication framework. A supplicant is authenticated to an authenticator via the use of

an authentication server (trusted third party), which can be implemented, for example, as a

Remote Authentication Dial-In User Service (RADIUS). However, it should be noted that

802.1X is not unique to WLANs and can be applied to any point-to-point network

[Dantu2007].

Next, we introduce the authentication procedure and different keys for 802.11i in general

level. Different key management schemes (e.g. the 4-Way Handshake) are discussed that

provide temporal keys for each session. Finally, we describe enterprise mode authentication

with more details by going through the EAP framework. We present requirements that are

10

imposed by the WLAN environment and introduce some popular EAP methods with their

suitability to the requirements.

4.1 Key generation

The purpose of the 802.11i authentication is to generate unique Pair-wise Master Key

(PMK), which can be used as an input for the key management protocols in order to

generate Pair-wise Transient Key (PTK). PTK can be used to open a secured

communication channel between the supplicant and authenticator. Key hierarchy during the

process is depicted in figure 2.

Key ConfirmationKey (KCK)

MasterSession Key

(MSK)

Pair-wise Master Key(PMK)

Pair-wise Transient Key(PTK)

The 4-WayHandshake

802.1X

Key EncryptionKey (KEK)

Temporal Key(TK) MIC Key

Figure 2: Key hierarchy

As we can see from the figure above, multiple keys are generated during the authentication

and key management. This ensures that keys are not repeated and therefore security is

increased. Keys are generated in the following phases [He2004][802.11-2007]:

i. The supplicant and authenticator will decide the used security policy, which

contains, for example, desired authentication method.

11

ii. The 802.1X authentication is performed between the supplicant and authenticator

by using the EAP method decided in previous step, resulting in a Master Session

Key (MSK).

iii. In enterprise mode, this MSK is used to derive a Pair-wise Master Key (PMK). In

personal mode, a shared secret (PSK), together with Service Set Identifier (SSID)

and its length are used to derive the PMK.

iv. PMK is used as an input for 802.11i key management protocols: The 4-Way

Handshake and/or Group Key Handshake. This phase results in a PTK for unicast

and/or Group Transient Key (GTK) for multicast and broadcast traffic.

v. After a successful handshake, a secure communication channel is established

between the supplicant and authenticator. The PTK is divided into four 128-bit

keys:

• Key Confirmation Key (KCK): Used to calculate Message Integrity Code

(MIC) values from the EAPOL frames.

• Key Encryption Key (KEK): Used to encrypt the EAPOL frames.

• Temporal Key (TK): Used to encrypt the 802.11 frames.

• MIC Keys: Used to provide data integrity to 802.11 frames.

4.1.1 Master Session Key

Master Session Key is a shared secret, which is created during an EAP authentication

between the supplicant and authenticator. MSK is at least 64 octets (512 bits) and it’s

generated during the following steps that represent the phase ii in the previous chapter

[802.11-2007]:

i. The authenticator and supplicant open their own port access entities (PAE) and the

EAP authentication is performed by using these ports.

ii. The supplicant sends an EAP start message to the authenticator to start the

authentication process. The messages are sent within EAP over LAN (EAPOL)

frames.

iii. The authenticator sends an EAP request to the supplicant by using the supplicant

corresponding PAE port.

iv. The supplicant sends an EAP response to the authenticators PAE port.

12

v. The authenticator converts EAPOL messages to the correct access request format

that the selected authenticator server uses (e.g. RADIUS messages) and forwards

those to the authentication server.

vi. EAP messages, based on the selected EAP method, are exchanged between the

supplicant and authentication server.

vii. MSK is generated after a successful EAP authentication and used to derive PMK.

Figure 3 illustrates the 802.1X authentication procedure in a general level.

Figure 3: Simplified sequence diagram of 802.1X authentication

4.1.2 The 4-Way Handshake

Purpose of the 4-Way Handshake is to generate a PTK. PTK is a 512-bit session based key,

which is derived from the PMK, authenticators address, supplicants address, authenticators’

nonce (ANonce) and supplicants’ nonce (SNonse) [802.11-2007]. The PMK has been

generated during the authentication and it should be noted that although the PMK can be

derived either from the MSK or obtained directly from the PSK, the handshake is

performed in the same manner. Furthermore, the latter four values are generated and

exchanged during the handshake. The 4-Way Handshake algorithm is represented in figure

4.

13

Supplicant Authenticator

ANonce

SNonce + MIC

DerivePTK

DerivePTK and

GTK

GTK + MICACK

Set temporal keys

Generate random nonces

Figure 4: A sequence diagram of the 4-Way Handshake

The handshake is initialized by the authenticator and done within four EAPOL-Key frames.

This procedure represents the steps iv and v of the general algorithm, described in chapter

4.1. These frames and operations during the handshake are described in the IEEE standard

[802.11-2007] and summarized by He et al. in “Analysis of the 802.11i 4-way handshake”

[He2004]:

• Firstly, a shared PMK is verified to be correct and known by the supplicant and

authenticator. In addition, the supplicant and authenticator generate their own nonce

with PRNG.

• The authenticator sends the first EAPOL-Key handshake message to the supplicant,

containing its nonce.

• The supplicant derives a fresh PTK from the PMK by using a pseudo random

function and sends its nonce within the second EAPOL-Key message to the

authenticator. Integrity of the message is ensured by calculating a MIC from the

message.

• The authenticator derives the PTK, generates a GTK if it is required, and sends

GTK to the supplicant within the third EAPOL-Key message.

• Finally, the supplicant acknowledges the handshake.

Moreover, IEEE 802.11i supports the Group Key Handshake, which is used to refresh the

used GTK.

14

4.2 EAP (Enterprise mode)

The 802.1X standard defines an EAP framework, which is used for authentication in the

enterprise mode. This framework was originally defined in RFC 3748 and later updated in

RFC 5247. EAP framework defines guidelines for authentication, in other words how a

supplicant is authenticated to an authenticator by using an authentication server, and does

not require use of a specific authentication protocol or predefined procedure. The 802.1X

consist of several different EAP methods, suitable for variety of network characteristics and

security requirements [Dantu2007]. In this paper, we’ll go through some commonly used

EAP methods and discuss suitable use for those. However, before going into EAP methods,

their requirements should be addressed in order understand their suitability for different

wireless environments.

RFC 4017 [Stanley2005] defines some mandatory requirements for an EAP method if it’s

used in a WLAN environment. These are also described by Dantu et al. in “EAP methods

for wireless networks” [Dantu2007] and summarized in the following:

a) An EAP method should be able to generate symmetric keying material for use in

post-authentication or data encryption.

b) An EAP method should support mutual authentication, at which time both

participants (the device and network) can authenticate each other.

c) Self-protection: An EAP method should be able to protect itself from eavesdropping

or other threats that might give information about the user or device.

d) An EAP method should support synchronization of state or certain attributes

between communicating parties. This means sharing information about the current

protocol, encryption method or keys.

e) Resistance to dictionary attacks and man-in-the-middle attacks; If an EAP method

uses secret password(s) then it must ensure that dictionary/brute force attacks are

handled. In addition, it must be able to protect itself from man-in-the-middle-

attacks, which means that a malicious entity acts in-between the device and AP.

This might, for example, require support to cryptographic binding, data integrity

protection and/or data replay protection.

15

In addition to the mandatory requirements, there are some recommended and optional

requirements, which can enhance the functionality of an EAP method in a WLAN

environment [Dantu2007]. These include, for example, support to message fragmentation

in authentication procedure, which is due to the limitations of the underlying physical layer.

For more information about these recommended and optional requirements, refer to

[Stanley2005], [Dantu2007] and [Lei2007].

4.2.1 EAP-Message Digest 5

MD5-EAP is a rather simple, legacy EAP method for exchanging password and user

identifier information between the supplicant and authentication server, encrypted via MD5

hash function. To achieve this, EAP-MD5 applies a challenge-based mechanism,

combining a random challenge with password and MD5. The method doesn’t offer any

way of changing symmetric key material (requirement a) and doesn’t provide mutual

authentication (requirement b). Therefore, it faces the same problem with static keys as

WEP and is vulnerable to dictionary attacks [Ali2007]. However, EAP-MD5 can be useful

in a situation where it’s combined with a more secure method that achieves these

requirements (e.g. EAP-TTLS) [Dantu2007], but in general it’s not recommended to use in

a wireless environment [Ali2007].

4.2.2 EAP- Transport Layer Security

EAP-TLS is defined in RFC 5216 and based on SSL v.3.0, which is widely used in secure

web transactions. It uses a public key certificate authentication procedure to authenticate

both the wireless clients and the authentication server by establishing an encrypted TLS

session [Ali2007]. It requires a full public key infrastructure (PKI) within the EAP

framework, in which every entity possesses a public key certificate, which has been signed

by an authority. The authority can be a trusted third party or built-in to the enterprise

[Dantu2007]. The advantage of this method is a strong level of security, but it might be

hard to implement in practice, especially with a large user-base or when devices are mobile

and frequently changing.

16

EAP-TLS provides symmetric key material (requirement a), mutual authentication between

the authenticator and supplicant (requirement b), and synchronization (requirement d)

[Dantu2007]. It meets the requirement of self-protection through the use of secured TLS

pipe (requirement c). Moreover, since passwords are not used, EAP-TLS is not vulnerable

to dictionary attacks, and mutual authentication removes the threat of man-in-the-middle

attacks (requirement e). Therefore, Ali et al. define it as a strongest EAP method for

wireless environment if only security is concerned [Ali2007]. However, the hard and costly

implementation can be a huge obstacle for deploying EAP-TLS. There is also an issue of

transmitting the certificates between all entities within the infrastructure.

4.2.3 EAP-Tunneled Transport Layer Security

EAP-TTLS was intended to overcome the difficulties of EAP-TLS and the usage of PKI in

client devices. Therefore, in EAP-TTLS, only server-side certificates are required

[Ali2009]. The method consists of the following steps:

i. The identity of an authentication server is verified through the use of an

asymmetric, public key algorithm.

ii. A symmetric encryption tunnel is created.

iii. The identity of the supplicant (client) is verified with another authentication method

(e.g. EAP-MD5) through the secure tunnel.

EAP-TTLS offers a strong security during the authentication, and thus, meets the

requirement of self-protection (requirement c). It provides means for generating symmetric

key material and mutual authentication (requirements a and b) [Ali2009]. Moreover,

requirements d and e are filled.

4.2.4 EAP-Subscriber Identity Module

EAP-SIM uses subscriber identity modules that provide the authentication method used by

many equipment provides in the field of cellular networking. The physical module acts as

storage of data and can contain, for example, the credentials for certain user or device. The

clients would then use this SIM to provide the necessary credentials during the

authentication procedure [Dantu2007]. Therefore, the method of applying EAP-SIM to

17

WLANs has similarities with the current authentication method of Global System for

Mobile Communications (GSM).

18

5 Wi-Fi Protected Access

WPA applies Temporal Key Integrity Protocol, which provides improved data encryption

and key management by using temporary frame-keys and stronger initialization vectors.

TKIP also utilizes non-linear Message Integrity Code (MIC) algorithm, which provides

enhanced data integrity compared to linear CRC-32 [Moen2004]. Following figure 5

illustrates the WPA (TKIP) encryption process, which is later described.

Figure 5 A block diagram of TKIP encryption.

The functionality of WEP is based on 128-bit Temporal Key. This key is obtained during

the authentication/key distribution procedure. Refer to chapter 4 for more information. TK

is used together with transmitter address (TA, 48 bits) and IV (48 bits) in key mixing

function. This hash function returns a unique 128-bit frame-key (also known as WEP key

or RC4KEY), which is used in encryption. This significant improvement, offered by TKIP,

ensures that secret key is not used directly in encryption purposes. For more information

about the functionality of this key mixing function, refer to [Housley2002]. TKIP uses

TKIP Sequence Counter (TSC), which ensures that the frame-key is used only for one

frame. The counter increases after each packet, which on the other hand acts as a defense

against data reply attacks because the receiver ignores packets with incorrect TSC.

19

TKIP provides an improved method for checking data integrity. This is achieved through

the usage of Message Integrity Code (MIC), which is calculated with Michael algorithm

and introduced in [Ferg2002]. This algorithm takes as an input the following components:

f) 64-bit MIC-key, which is derived during the authentication process. The 128-bit

MIC key is divided into two parts [Halv2009]. The first part is used in the

communication from the access point to the client and vice versa.

g) Destination Address (DA, 48 bits).

h) Source Address (SA, 48 bits).

i) Priority field (8 bits).

j) Unencrypted payload (plaintext).

TKIP encrypts the MIC, which makes MIC forgery harder. The MIC isn’t calculated over

the Medium Access Control Protocol Data Unit (MPDU) because that would decrease the

flexibility with older hardware. When the MIC is calculated, it is concatenated with the

plaintext and forwarded to encryption. Encapsulated WPA frame (appendix c) is sent to the

receiver [802.11-2007].

Decapsulation of the WEP frame is started by checking that TSC is in correct order. The

message is discarded if the TSC is out of order, otherwise the ciphered MPDU is sent to the

WEP decapsulation process [802.11-2007]. In addition, Frame Check Sequence (FCS) and

ICV are checked before calculating the MIC. Before WEP decapsulation can be done a

WEP seed needs to be created. The receiver calculates the frame key in a similar fashion

than the sender and gives the seed to WEP as an IV. If the WEP decapsulation process is

successful, the defragmented Medium Access Control Service Data Unit (MSDU) is

provided to the next step in the decapsulation process. If defragmentation fails, the packet

is discarded. After the defragmentation, TKIP checks that the received MIC inside the

packet is valid.

The WPA protocol managed to fix the main problems of WEP by providing enhanced data

encryption and authentication with key management. However, WPA was a temporary

solution and thus some compromises were made, for example, when choosing a old

cryptographic algorithm (RC4) instead of AES. In addition, the usage of hash functions

20

within the TKIP key mixing function can produce unnecessary threats, for example, during

a hash collision [Sarmi2008]. This problem of WPA is also pinpointed in [Moen2004].

21

6 Wi-Fi Protected Access 2

WPA2 protocol is an enhancement over WPA and fully implements the IEEE 802.11i

standard. For this reason, the terms 802.11i and WPA2 are often used interchangeably

[Lash2009]. WPA2 introduces a new encryption protocol called Counter Mode with Cipher

Block Chaining Message Authentication Code, which is based on Advanced Encryption

Standard. Actually, the protocol consists of two different modes of AES, as defined in the

name of the protocol:

• Counter-Mode (CTR), which ensures data privacy and confidentiality by handling

the encryption of the frame.

• Cipher Block Chaining-Message Authentication Code (CBC-MAC) mode,

which provides data integrity.

AES is a symmetric block cipher, which was introduced by the National Institute of

Standards and Technology (NIST) as a successor for Data Encryption Standard (DES) in

November 2001. It’s well documented, free of royalties or patents, and secure encryption

algorithm [Lash2009]. In WPA2, the encryption key is 128 bits long, derived from 802.1X

authentication and different key management schemes discussed earlier. Therefore, in the

WPA2 implementation of AES, the message is encrypted in 128-bit blocks that are

calculated independently, rather than having a RC4 key stream acting across the input

stream. However, TKIP is also supported by WPA2, as it’s defined in IEEE 802.11i, to

ensure backwards compatibility with WPA implementations.

WPA2 uses CBC-MAC mode of AES to ensure data integrity by generating a chained

authentication component from the unencrypted frame. This differs from WPA, in which a

separate algorithm (Michael) was used for generating MIC. Moreover, WPA2 removes the

threats that might arise from the usage of hash-functions in TKIP key mixing function (e.g.

due to a hash collision) [Sarmi2008]. The algorithm for calculating CBC-MAC, and thus

ensuring data integrity for current frame, consists of the following steps:

22

i. An initialization block is constructed from the following components:

• Flag field (8 bits) is set to 01011001. This field contains various flags, which

define, for example, that the used MIC length is 64 bits and data length field is

16 bits.

• Priority field (8 bits), which is fixed to 0 and reserved for future usage.

• Transmitter Address (48 bits)

• Packet Number (PN, 48 bits), which is incremented for each subsequent packet

and similar to the TSC of WPA. If the PN is invalid, packet is discarded.

• Data length field (16 bits)

The constructed block, illustrated in table 1, is fed to the AES together with data

integrity key, derived from authentication and key management. The result can be

considered as an IV for calculating MIC.

Table 1: CBC-MAC Initialization block

Bit index 0-7 8-15 16-63 64-111 112-127Content 01011001 00000000 Transmitter

addressPacket number Data length

ii. XOR function is applied to the result from previous step and selected 128 bits from

the 802.11 frame header: Frame Control, Address 1, Address 2 and Hlen. Refer to

appendix A for more information about the 802.11 MAC frame or figure 6.

iii. The result from step ii is introduced into AES.

iv. XOR function is applied to the result from previous step and other selected fields

from the frame header: Address 3, Sequence Control, Address 4 and Quality of

Service (QoS) Control.

v. The result from step iv is ciphered with AES.

vi. XOR function is applied to the result from previous step and first 128 bits of the

payload.

vii. The result from step vi is ciphered with AES, producing a 128-bit block.

viii. Steps vi and vii are repeated until the whole payload has been ciphered. Packet

Number field is excluded, because it was already part of the initialization block.

23

If the final block is less than 16 octets (128 bits) it’s padded with zeroes to match in size.

The explained CBC-MAC results in a 128-bit block that was generated over the whole

frame, starting from the headers to the end of payload, in a chained manner. The 64 most

significant bits (msb) are taken to represent the MIC for the frame and concatenated

unencrypted to the end of payload before ciphering with AES counter mode.

Figure 6: CBC-MAC algorithm

The counter mode algorithm encrypts data and MIC of the frame in following steps:

24

i. An initial block is constructed from the following components:

• Flag field (8 bits) is set to 01011001, which is same as with MIC initial

block.

• Priority field (8 bits) is again initialized to zero.

• Transmitter Address (TA, 48 bits)

• Packet Number (PN, 48 bits)

• Counter (16 bits), which is fixed at 1 and increased for every 128-bit block

until everything has been encrypted.

The constructed IV block is ciphered with AES and data encryption key.

Table 2: 802.11i Counter-Mode initialization block

Bit index 0-7 8-15 16-63 64-111 112-127Content 01011001 00000000 Transmitter

addressPacket number Counter

ii. XOR function is applied to the result from previous step and first 128 bits from the

clear text payload. This produces the first 128 ciphered bits.

iii. The counter from IV is increased, ciphered with AES, and XORed with next 128

bits of payload. This step is repeated until the payload and concatenated MIC

(CBC-MAC) has been encrypted. For MIC encryption the counter of the initial

block is not increased, but is set to 0. Only 64 most-significant bits are XORed with

the MIC.

The following figure 7 presents the functionality of AES in counter mode for 802.11.

Decapsulation of the encrypted MPDU is done in reverse order. If the PN is invalid the

packet is discarded. Moreover, the MIC calculated in receiver side must match to the one

that was encrypted within the frame.

25

Figure 7: AES in Counter-Mode for 802.11

26

7 CONCLUSIONS

In this paper, we have presented a detailed description of different protocols for securing

IEEE 802.11 communication. WEP, WPA and WPA2 are discussed together with the IEEE

802.1X authentication framework and key management schemes, in order to give the

overall understanding of the current situation in the field of WLAN security. WEP fails to

provide an adequate level of security to match with the modern threats and level of raw

computing power. Its successor (WPA) suffers from its legacy background, because it was

intended to be compatible with existing WEP hardware. In addition, modern attacks against

WPA have been identified. However, the TKIP protocol applied by WPA can overcome the

main weaknesses of WEP.

WPA2, on the other hand, provides a good level of security through the use of government-

grade encryption algorithm AES and implementing the whole IEEE 802.11i security

standard. When these features are combined with a functional authentication mechanism,

we feel that it can provide the necessary level of security for different WLAN

environments, ranging from small offices to larger enterprises.

The following table 3 concludes the different WLAN security protocols.

Table 3: WLAN security protocols

Description WEP WPA WPA2Authenticationmethod

None 802.1X/Pre-Shared-Key

802.1X/Pre-Shared-Key

Encryption protocol WEP TKIP CCMPCryptographicalgorithm

RC4 RC4 AES

Key length (bits) 40* 128 128IV length (bits) 24 48 48Data integrityalgorithm

CRC-32 Michael (MIC) CBC-MAC

Protection againstdata replay attack

None Yes. The IV ofWPA (TSC) acts asa counter.

Yes The usage ofpacket numbering.

* = WEP also supports the usage of 104 bit keys and this is supported by manymanufacturers.

27

REFERENCES

[802.11-2007] IEEE Std. 802.11 -2007, “Wireless LAN Medium Access Control (MAC)

and Physical Layer (PHY) Specifications”, IEEE Computer Society, June 2007

[802.11i-2004] IEEE Std. 802.11i -2004, “Medium Access Control (MAC) Security

Enhancements”, IEEE Computer Society, June 2004

[Ali2007] K. Ali and T. Owens, “Selection of an EAP authentication method for a

WLAN”, International Journal of Information and Computer Security, vol. 1, issue 1, pp.

210-233, January 2007

[Bulbul2008] H. Bulbul, I. Batmaz, and M. Ozel, “Wireless network security: comparison

of WEP (Wired Equivalent Privacy) mechanism, WPA (Wi-Fi Protected Access) and RSN

(Robust Security Network) security protocols”, Proceedings of the 1st international

conference on Forensic applications and techniques in telecommunications, information,

and multimedia and workshop, no. 9, 2008

[Bulk2006] Frank Bulk, “The ABCs of WPA2 Wi-Fi Security”, Network Computing, 17, 2,

pp. 65-69, February 2, 2006

[Dantu2007] R. Dantu, G. Clothier, and A. Atri, “EAP methods for wireless networks”,

Computer Standards & Interfaces, vol. 29, issue 3, pp. 289-301, March 2007

[Ferg2002] Niels Ferguson, “Michael: an improved MIC for 802.11 WEP”,

IEEE document 802.11-02/020r0, 2002

[Halv2009] F. Halvorsen and O. Haugen, “Cryptanalysis of IEEE 802.11i TKIP”, Master’s

thesis, Norwegian University of Science and Technology, 2009

28

[He2004] C. He and J. Mitchell, “Analysis of the 802.11i 4-way handshake”, Proceedings

of the 3rd ACM workshop on Wireless security, pp. 43-50, 2004

[Housley2002] R. Housley, D. Whiting, and N. Ferguson, “Alternate temporal key hash”,

IEEE document 802.11-02/282r8, April 2002

[Lash2009] A. Lashkari, M. Danesh, and B. Samadi, “A Survey on Wireless Security

protocols (WEP, WPA and WPA2/802.11i)”, 2nd IEEE International Conference on

Computer Science and Information Technology, pp. 48-52, August 2009

[Lei2007] J. Lei, X. Fu, D. Hogrefe, and J, Tan, ”Comparative Studies on Authentication

and Key Exchange Methods for 802.11 Wireless LAN”, Computers & Security, vol. 26,

issue 5, pp. 401-409, August 2007

[Moen2004] V. Moen, H. Raddum, and K. Hole, “Weaknesses in the temporal key hash of

WPA”, ACM SIGMOBILE Mobile Computing and Communications Review, pp. 76-83,

April 2004

[Sarmi2008] O. Sarmiento, F. Guerrero, and D. Argote, “Basic Security Measures For

IEEE 802.11 Wireless Networks”, Ingenieria e investigacio, pp. 89-96, vol. 28, issue 002,

2008

[Stanley2005] D. Stanley, J. Walker, and B. Aboba, “Extensible Authentication Protocol

(EAP) Method Requirements for Wireless LANs”, RFC 4017, March 2005

29

APPENDICES

Appendix A: 802.11 MAC frame format

The following figure represents the 802.11 MAC frame format [802.11-2007].

Appendix B: Payload of 802.11 frame with WEP encryption.

The following figure depicts the data field (frame body) of 802.11 a MAC frame, when

WEP encryption is enabled [802.11-2007].

30

Appendix C: TKIP MPDU

The following figure illustrates TKIP MPDU, in which the MAC Header part is depicted in

Appendix A [802.11-2007].

Appendix D: CCMP MPDU

The following figure illustrates CCMP MPDU, in which the MAC Header part is depicted

in appendix A [802.11-2007].