Solutions for WEP Bracha Hod June 1, 2003

i Task Group  Addresses WEP issues –No forgery protection –No protection against replays –Attack through weak keys –IV re-use  But has constraints –Needs a firmware patch: large market already –Access Points have cheap processor –Part is hardwired in the devices

3 Robust Secure Network  Interim solution –Use constrains –802.1x - authentication and key management –TKIP - data encapsulation  Longterm solution –Ignore constrains –802.1x - authentication and key management –AES - data encapsulation

802.1X

x Architecture  Allows choice of auth. methods using EAP –Chosen by peers at authentication time –Access point doesn’t care about EAP methods  Requires some authentication server –RADIUS is the de facto back-end protocol 802.1X (EAPoL) EAP-TLS EAP RADIUS UDP/IP

X Terminology  Port-based access control mechanism –Ports for passing data without authentication –Parts for passing data only after authentication Supplicant Authentication Server Authenticator Controlled port Uncontrolled port

x Model Supplicant Authentication Server Authenticator Authentication traffic Normal Data Port Status: EAP Identity Request Associate EAP Auth Response EAP Auth Request EAP Identity Response Radius802.1x EAP-Success

x Advantages  Standards-based  Flexible authentication  Scalable to large enterprise networks  Centrally managed  Roaming can be made as transparent as possible  Keys are dynamically generated and propagated

x Flaws  Possible attacks –Man-in-the-middle –Session hijacking –Denial-of-service attacks  Solutions –Strong mutual authentication by protocols like EAP-TLS, EAP-TTLS and EAP-PEAP which provide strong master-key in the end –The area of coverage of an access point is small enough that an attacker would have a substantial risk of discovery

TKIP

11 Temporal Key Integrity Protocol  Designed as a wrapper around WEP –Can be implemented in software –Reuses existing WEP hardware –Runs WEP as a sub-component  Components –Cryptographic message integrity code –Packet sequencing –Per-packet key mixing –Re-keying mechanism

12 MIC  Sender and receiver share 64-bit secret key  MIC = h (src MAC|dst MAC|frame body)K  If receivers computation matches the MIC sent, then message presumed authentic  If 2 forgeries in a second, then assume under attack (delete keys, disassociate, and reassociate) 8 byte MIC SADAPayload Michael Authentication Key

13 Packet Sequencing  Reuse 16-bits of WEP IV packet field for sequence number  Initialize seq# to 0 on new encryption key  Increment seq# by 1 on each packet  Discard any packet out of sequence Access Point Wireless Station HdrPacket n HdrPacket n + 1 HdrPacket n

14 Key Mixing  Phase 1: –Key_mix1(128-bit temporal key, 48-bit MAC) –128-bit result –Ensure unique key if clients share same temporal key  Phase 2: –Key_mix2(phase1 result,seq#) –The result is 128-bit per-packet key –Incrementing seq# ensure unique key for each packet  Keystream = RC4(128-bit per-packet key)

15 Key Mixing  The keys are 128-bit  The transmitter address is 48-bit  The sequence number is 16-bit Transmitter Address: 00-A0-C9-BA-4D-5F Temporal key Phase 1 Mixer Intermediate key Per-packet key Phase 2 Mixer Packet Sequence #

16 Rekeying  Key hierarchy –Master key Established via 802.1x or manually Used to securely communicate key encryption keys –Key encryption keys (2) Secure messages containing keying material for deriving temporal keys Key 1: encryption data 128-bit Key 2: data integrity 64-bit –Temporal keys (2) Key 1: encrypting data 128-bit Key 2: data integrity 64-bit

17 Putting The Pieces Together

18 Summery  Advantages –Fixes several issues in WEP –Companies having existing WEP-based equipment can upgrade to TKIP through relatively simple firmware patches  Disadvantages –Relies on the original security specifications –Not ideal solution  “We should all realize that TKIP is really a kludge. We are trying to make the best of a difficult situation, but TKIP should be phased out as soon as possible…”

AES

20 Requirements  Use encryption properly –In particular The protocol must never reuse nonces or IVs or other information used to randomize the encryption function  Defend against forgeries and replays –In particular, a design must never reuse keys  Protect the source and destination addresses from modification  Minimize the cost: –Minimize the number of cryptographic primitives used –Minimize the software expenses  Use the best practice cryptographic primitives

21 AES-based Encapsulations  Replaces RC4 with AES for encryption and integrity  Requires coprocessor, therefore new hardware deployment  AES –Symmetric key block cipher –Require sequence counter, 128-bit key  Two cryptographic modes: –AES-CCM (CCMP): Counter Mode with CBC-MAC –AES-OCB (WRAP): Offset Codebook

22 Counter Mode & CBC-MAC EKEK ctr 1 c1c1 m1m1 EKEK ctr 2 c2c2 m2m2 EKEK ctr 3 c3c3 m3m3 EKEK ctr n-1 c n-1 m n-1 EKEK ctr n cncn mnmn EKEK EKEK EKEK m n-1 EKEK mnmn cmcm IV c 0 =IV c j =E K (m j  c j-1 ) MAC=c m c j =E K (ctr j )  m j m1m1 m2m2

23 AES-CCM  Use CBC-MAC to compute a MIC on the MPDU + header fields  CTR mode to encrypt the payload and the MIC  The counter for encryption and the IV for MIC are made by concatenation of the sequence counter and header fields HeaderPayload Encrypted MIC Authenticated bit sequence counter AES key Seq CTR

24 OCB … Full tag   offset EKEK checksum   offset EKEK m1m1 c1c1 offset   L(0)   offset EKEK m2m2 c2c2 offset   L(1) EKEK mnmn cncn    L(-1) Pad Len(m n ) offset   L (ntz(n))   ossfet EKEK Nonce Offset   L  L L = E K (0)

25 AES-OCB  OCB provides both data privacy and data authenticity by a single AES-key and 28-bit sequence counter  The nonce of OCB is made by concatenation of the sequence counter and header fields HeaderPayload Encrypted MIC Authenticated bit sequence counter AES key Seq CTR

26 CCM vs. OCB  Security –OCB mode appears to be superior for data authentication  Performance –In hardware there are no difference –In software, AES-OCB enjoy about 2:1 performance advantage over AES-CCM  Patent situation –OCB has patent, while CCM doesn’t

27 Today & The Future  2000 – WEP –Better than no security  x–WEP –Fixes authentication issues for legacy equipment  i–TKIP –Fixes known encryption issues for legacy equipment  i-AES –Next generation security for future products

Thank You!