doc.: IEEE /0899r2 Submission July2010 Dan Harkins, Aruba NetworksSlide 1 Secure PSK Authentication Date: Authors:

doc.: IEEE /0899r2 Submission July 2010 Dan Harkins, Aruba NetworksSlide 2 Abstract This presentation presents the problems with D0.1’s use of PSKs and a solution to them.

doc.: IEEE /0899r2 Submission July 2010 Dan Harkins, Aruba NetworksSlide 3 What’s the Problem? PSKs are being used for authentication in a PBSS It is difficult to provision a “strong” PSK. –Strength is a function of entropy in the PSK. –For a character-based PSK there is approximately 1.5 bits of entropy per character. –Generating a key suitable for use with GCM implies a character string of around 100 characters. –Humans have a hard time entering a string of 20 characters repeatedly with a low probability of error. Weak PSKs will be used because doing otherwise is prohibitive and problematic for operators and users. –Need a robust protocol to use PSKs properly, can’t just mandate all PSKs are uniformly random binary strings of sufficient length.

doc.: IEEE /0899r2 Submission Okay, So What’s the Problem? The PSK is leaked when used in Draft 0.1 –Using the PSK directly in the 4-Way Handshake has known and well- published problems. Cracking tools available on the Internet. –A PSKID, based on a hash of the PSK, is included in beacons. Protocols using the PSK are susceptible to an off-line dictionary attack –An attacker has all information needed to run through a dictionary of potential passwords until the correct one is found. –This attack is not detectable by legitimate members of the PBSS. Learning the PSK allows an attacker to recover all past and future traffic. The strength of the PSK determines the strength of the GCM key and that’s not strong enough (see previous slide). July 2010 Dan Harkins, Aruba NetworksSlide 4

doc.: IEEE /0899r2 Submission What’s the Solution? A protocol that uses a PSK that is resistant to attack –Each active attack leaks a single bit of information– whether the singular guess was correct or not. Passive attack is not possible. –Probability of guessing the PSK is 1/(S-x) after x guesses of the PSK from a pool of possible PSKs of size S. –Perfect Forward Secrecy is achieved. A protocol which can produce a cryptographically strong key suitable for use with GCM –An entropy amplifier! –The strength of the PSK does not determine the strength of the GCM key. A robust, misuse-resistant protocol A protocol called SAE from the 11s draft July 2010 Dan Harkins, Aruba NetworksSlide 5

doc.: IEEE /0899r2 Submission SAE Based upon the Dragonfly key exchange. –Secure against active, passive and dictionary attack Uses public key cryptography to produce a strong GCM key that is authenticated with a (potentially weak) PSK. An RSNA authentication protocol for Uses authentication frames (not data frames). Free, open source (BSD licensed) reference implementation available: July 2010 Dan Harkins, Aruba NetworksSlide 6

doc.: IEEE /0899r2 Submission July 2010 Dan Harkins, Aruba NetworksSlide 7 References ad-secure-psk-authentication.doc

doc.: IEEE /0899r2 Submission Backup Is PSK insecurity really a big deal? In a word: yes. –The Church of WiFi has released DVDs containing all permutations of the 1,000 most popular SSIDs and the 1,000,000 most popular passwords. –There are off-the-shelf tools to crack PSKs aircrack-ng – available for Windows and Linux coWPAtty – available for Windows and Linux –Don’t have the wherewithal to run off-the-shelf tools with easily obtained DVDs? Don’t worry! WPA Cracker offers a cloud cracking service: August 2010 Dan Harkins, Aruba NetworksSlide 8

doc.: IEEE /0899r2 Submission Backup WPA Cracker –Available with both English and German dictionaries! –The “standard” English dictionary has 136 million PSKs in it. The “extended” English dictionary has an addition 284 million PSKs. The “numbers” dictionary has an additional 100 million PSKs. Combine them all for an aggregate dictionary of 520 million PSKs! –It takes an average of 20 minutes and costs only $17 “Simply upload your network capture, start your job, and WPA Cracker will you the results within minutes!” –With 11ad all an attacker needs is a beacon to give to WPA Cracker! August 2010 Dan Harkins, Aruba NetworksSlide 9

doc.: IEEE /0899r2 Submission Backup PSK problems have generated considerable bad press and problems for IEEE Std –"Weakness in Passphrase Choice in WPA Interface". 04 Nov Bob Moskowitz –“Hacking WEP and WPA-PSK”, 20 Mar –The Chinese government has proposed a replacement for at ISO (JTC1/SC6) and the security issues with PSK are the justification they’re using– “ is insecure, WAPI fixes it” Do you really want to see the following headlines? –“New wireless gigabit standard broken already” –“A red carpet to hackers, the latest offering from ” August 2010 Dan Harkins, Aruba NetworksSlide 10