Skip to content
Search

Wi-Fi Protected Access

lastmod 2020-06-27created 2015-05-0710 edits

Wi-Fi Protected Access (WPA, WPA2) is a certification program run under the supervision of the Wi-Fi Alliance, and a security protocol indicating that network equipment complies with the security protocols defined by the Wi-Fi Alliance. The WPA protocol came out as an alternative to the earlier Wired Equivalent Privacy (WEP) because of its vulnerabilities. It is a protocol implementing the major parts of IEEE 802.11i, and was developed for temporary use as an alternative to WEP until 802.11i was completed. It is designed so that wireless LAN cards predating WPA support can also use it (via firmware update), but it does not work on first-generation access points (wireless LAN). The WPA2 certification mark indicates that the device fully complies with the extended protocol standard. This extended protocol does not work on previous-generation wireless LAN cards.

Overview

  • Developed by the Wi-Fi Alliance (WFA) before full approval of IEEE 802.11i (complies with Wi-Fi security standards)
  • Improved data encryption through the Temporal Key Integrity Protocol (TKIP)
  • User authentication through the Extensible Authentication Protocol (EAP) (usually absent in WEP)
  • WPA2, the second generation of WPA, has improved security features and consists of Advanced Encryption Standard (AES) encryption, pre-authentication, and PMKID caching
  • WPA and WPA2 are not interoperable, so that the supplicant device and the authenticator can be configured with the same WPA version and Pre-shared Key (PSK)
  • WPA supports only BSS (infrastructure) mode; WPA2 supports BSS (infrastructure) mode and IBSS (Ad hoc) mode

Tips

  • WPA-PSK (Pre-shared Key) is also called WPA-Personal.
  • WPA v1 mainly uses the TKIP encryption algorithm, and WPA v2 uses the AES-CCMP algorithm, which is stronger than TKIP
  • The TKIP encryption algorithm improves on the weaknesses of WEP and has the advantage of being usable on any equipment that supports WEP
  • WPA v1 / WPA v2 use either an EAP-based authentication method with a Radius Server or an authentication method using a PSK (Pre-Shared Key)
  • WPA v1 / WPA v2 have the drawback that once all parameters are found by capturing the 4-Way Handshake, they become highly vulnerable to a Dictionary Attack

4-Way Handshake

111011_1450_WirelessHac1.png

  • The core of WPA v1 / WPA v2 PSK operation is computing a Session Key called the Pairwise Transient Key (PTK) from the Pre-Shared Key (PSK) and five parameters.
  • The wireless AP and Client encrypt all data using this Key
  • The five parameters
    • Network SSID
    • Authenticator nonce (ANounce)
    • Supplicant nonce (SNounce)
    • Authenticator MAC address (the AP's MAC Address)
    • Supplicant MAC address (the wireless Client's MAC Address)

How it works

  • The attacker captures the entire 4-Way Handshake through wireless sniffing and obtains all 5 parameters.
  • The Pre-Shared Key (PSK) is computed using the user-entered WPA-PSK passphrase and SSID. Feeding the two arguments into the Password Based Key Derivation Function (PBKDF2) outputs a 256-Bit shared key
  • Using an attack tool, a 256-Bit Pre-Shared Key (PSK) is generated for each password and then combined with the other parameters to generate the PTK.
  • Here, the PTK is used to verify the Message Integrity Check (MIC) in one of the Handshake packets.
  • Therefore, if the authorized network password exists in the dictionary, the attacker can Crack the password.

Process

111011_1450_WirelessHac2.png

TKIP

  • Improves data encryption performance using a hashing algorithm
  • Data encryption methods are greatly improved, including a rekeying method
  • Part of the IEEE 802.11i encryption standard for wireless LANs; the next-generation WEP used to protect 802.11 wireless LANs
  • Fixes the flaws of WEP by providing per-packet key mixing, message integrity checks, and a rekeying mechanism.

CCMP (AES-based)

  • An IEEE 802.11i encryption protocol created to replace TKIP, the mandatory protocol of WPA and WPA2
  • A mandatory element of the WPA2 standard, an optional element of the WPA standard, and a required option for networks that follow RSN
  • Uses the Advanced Encryption Standard (AES) algorithm

WPA2-PSK

Short for Wi-Fi Protected Access 2 - Pre-Shared Key, and also called WPA or WPA2 Personal, it is a method of securing your network using WPA2 with the use of the optional Pre-Shared Key (PSK) authentication, which was designed for home users without an enterprise authentication server.

To encrypt a network with WPA2-PSK you provide your router not with an encryption key, but rather with a plain-English passphrase between 8 and 63 characters long. Using a technology called TKIP (for Temporal Key Integrity Protocol), that passphrase, along with the network SSID, is used to generate unique encryption keys for each wireless client. And those encryption keys are constantly changed. Although WEP also supports passphrases, it does so only as a way to more easily create static keys, which are usually comprised of the hex characters 0-9 and A-F.

WPA3

See also

Favorite site

author Zer0 sitemap