Show
In the wireless authentication lesson, you learned that the original 802.11 standard only supported WEP and open authentication. WEP is insecure and shouldn’t be used anymore. In this lesson, we’ll take a look at some of the other algorithms and protocols to encrypt and protect the integrity of wireless traffic.
TKIPWEP uses the RC4 algorithm for encryption, which is supported in hardware. Most wireless equipment only supported RC4 and not a more advanced encryption algorithm like AES. We know that WEP is insecure, so to make sure that the older hardware could still use a secure encryption method, IEEE developed the Temporal Key Integrity Protocol (TKIP). TKIP adds the following security features:
TKIP was a temporary solution, while IEEE worked on the 802.11i standard. Nowadays, TKIP also has vulnerabilities, and you shouldn’t use it anymore. TKIP is deprecated in the 802.11-2012 standard. CCMPCCMP stands for Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. That’s a mouthful. CCMP consists of two algorithms:
Advanced Encryption Standard (AES) is a widely used encryption algorithm and the most secure encryption method available at the moment. The National Institute of Standards and Technology (NIST) has defined five modes of operation for AES (and other FIPS-approved block ciphers). The five modes are:
Cipher Block Chaining Message Authentication Code (CBC-MAC) is a technique that constructs a message authentication code from a block cipher. The data is encrypted with AES and creates a chain of blocks. Each block depends on the encryption of the previous block. Before you can use CCMP, your wireless hardware has to support AES and CBC-MAC. You can’t use CCMP on older hardware that only supports WEP or TKIP. WPA2 uses CCMP, so if you want to know if your hardware supports CCMP, look for the WPA2 symbol. WPA2 has been out since ~2006 so most hardware supports CCMP. GCMP802.11ad offers even higher data rates than 802.11ac and requires faster encryption than CCMP can offer. Galois/Counter Mode Protocol (GCMP) can be run in parallel, so it’s more efficient and provides higher performance than CCMP. 802.11 Security SolutionsSecurity Basics - 802.11 - 802.11 Solutions - BluetoothDue to WEP's weaknesses both in authentication and in encryption, the IEEE is currently working to ratify a new standard, 802.11i, that will address both these critical issues in wireless network security. Although drafts of the standard have already been written and are being circulated within the engineering community, vendors have sought at least temporary security fixes to boost their network security until the new standard is released. WiFi Protected Access (WPA) is a standard created by the WiFi alliance that contains a subset of the technologies outlined in the 802.11i draft, and is the standard in place for current wireless network technology. EncryptionTo upgrade the cryptographic technology, WPA has put forth the Temporal Key Integrity Protocol (TKIP) as a solution that fixes the major problems with WEP. Upgrading to TKIP will not require hardware changes, as the cryptographic algorithm used will still be RC4, as in WEP. In TKIP, the wireless access point and the device will share a 128-bit key, called the temporal key. This temporal key is mixed with the transmitter’s MAC address, which results in a Phase 1 key, which is mixed with a 48-bit initialization vector to produce keys that are unique from packet to packet. The RC4 algorithm uses this key to encrypt this single data packet. The shared temporal key is also periodically changed to provide further security. TKIP also provides additional preservation of data integrity with a message integrity code that uses a one-way hash that is much more secure than the WEP integrity check value that could be updated by an attacker without even knowing the WEP key. Temporal key derivation: This is different in concept because it does not use the secret master key to directly encrypt data packets, but instead, uses it to seed a derivation of transient encryption keys to feed into the per-packet hash function. In 802.11b, the secret key is used directly as the encryption key. Temporal keys must be recalculated in time before the IV space can be exhausted; with a 48-bit IV, this allows for a huge number of packets before a new temporal key is necessary. However, TKIP is only an interim solution to the encryption problem. TKIP provides immediate aid to businesses that need to maintain security on their wireless networks without upgrading their hardware, but 802.11i is working on producing a standard encryption scheme that makes use of the 128-bit advanced encryption standard (AES). This scheme, called the counter mode cipher block chaining with message authentication codes protocol (CCMP) is essentially a replacement for the WEP functionality. CCMP has a 48-bit IV that seeds both the key derivation process and the message integrity code for the CCMP packets. CCMP will be phased in more slowly with TKIP as the immediate encryption solution, because the implementation of CCMP requires new hardware to handle the robust AES encryption-processes. While TKIP and CCMP will address the encryption problems that WEP had, there is still a need for a satisfactory authentication process. AuthenticationThe new 802.11i standard will incorporate an authentication protocol similar to an already-existing standard, called 802.1x. 802.1x is a port-based authentication system that is used in wired Ethernet systems, which means that modifications will need to be made in order to provide all the authentication methods needed for WLANs. Some of these methods include: mutual authentication, key management and dictionary attack resistance. In 802.1x, the initial authentication process allows an association between the wireless client and the access point, although the device is allowed only to send authentication information at this point and is not permitted to access the internal network. 802.1x uses Extensible Authentication Protocol (EAP) in order to handle the authentication requests. The access point then forwards the authentication information to a back-end server through Remote Authentication Dial-In User Service (RADIUS) in order to verify the authentication information. If the client provides the proper information, then the server sends a message to the AP to grant network access to the AP. After first authentication, the authentication process will repeat periodically to verify that the client has not been subverted. A virtue of the EAP is the flexibility it encompasses, since the mechanism can be easily replaced with a stronger authentication process. Top of page How many bits are used for initialization vector for TKIP?In TKIP, the wireless access point and the device will share a 128-bit key, called the temporal key. This temporal key is mixed with the transmitter's MAC address, which results in a Phase 1 key, which is mixed with a 48-bit initialization vector to produce keys that are unique from packet to packet.
Which wireless protocol uses TKIP Temporal Key Integrity Protocol )?TKIP is the encryption method used in Wi-Fi Protected Access (WPA), which replaced WEP in WLAN products. TKIP is a suite of algorithms that works as a "wrapper" to WEP, which allows users of legacy WLAN equipment to upgrade to TKIP without replacing hardware.
What size initialization vector is used in WPA2?What size initialization vector is used in WPA2? CCMP uses 128-bit AES encryption with a 48-bit initialization vector.
Which form of wireless encryption introduced the Temporal Key Integrity Protocol TKIP security protocol?Temporal Key Integrity Protocol (TKIP /tiːˈkɪp/) is a security protocol used in the IEEE 802.11 wireless networking standard. TKIP was designed by the IEEE 802.11i task group and the Wi-Fi Alliance as an interim solution to replace WEP without requiring the replacement of legacy hardware.
|
What size is the initialization vector IV for the temporal key integrity protocol TKIP used in the WPA standard?
zusammenhängende Posts
Urheberrechte © © 2024 paraquee Inc.
