Enhanced 802.11 Security Date: 2008-05-11 Authors: May 2009 May 2009 doc.: IEEE 802.11-09/0315r2 May 2009 Enhanced 802.11 Security Date: 2008-05-11 Authors: Dan Harkins, Aruba Networks Dan Hakrins, Aruba Networks

May 2009 doc.: IEEE 802.11-09/0315r2 May 2009 Abstract This document describes important security features that are missing from, or will enhance, IEEE 802.11 and proposes a way to add them to IEEE 802.11. Dan Harkins, Aruba Networks Dan Hakrins, Aruba Networks

Security Services in 802.11 Key Management Ciphers May 2009 Authentication: A STA can prove its identity to the network and vice versa Authorization and Access Control: Once authenticated a STA can be given access to the network, or a subset of it, or denied access to the network. Key derivation: each side derives a key known bound to each other. Ciphers Data Confidentiality: Data sent between the STA and AP is hidden from all but the source and destination of the data. Data Integrity: The recipient of a frame is able to verify that the frame was not modified in transit and that a false frame has not been substituted for a valid frame. Data Source Authentication: The recipient of a frame is able to ascertain the origin of the frame and it is not possible for anyone else to masquerade as the claimed originator. Dan Harkins, Aruba Networks

How are These Services Provided Today? May 2009 How are These Services Provided Today? Wired Equivalent Privacy (WEP) Key Management Shared key: insecure simple proof-of-possession of a shared key Cipher WEP: insecure, numerous fundamental flaws in design Robust Security Network (RSN) 802.1x: provides mutual authentication, allows for authorization and access control decision making, generates secure and cryptographically strong keys. PSK: provides a limited type of authentication, generates weak keys that void some features of RSN ciphers. Ciphers TKIP: provides confidentiality, data integrity (sub-optimally), and data source authentication. CCMP: provides confidentiality, data integrity, and data source authentication. WEP is deprecated and should not be used. That leaves RSN as the only option available. Dan Harkins, Aruba Networks

May 2009 What’s The Problem? Cryptographically strong security is limited to one particular use case– the enterprise-- where: a AAA server is used to aggregate security services and policy. strict roles are enforced: clients obtain network access through APs. Cryptographically strong security doesn’t really work for other deployments. Small office/home office– a stand-alone AAA server is problematic. Networks of consumer electronics devices– a stand-alone AAA server is a non-starter and there is no real “client” and “AP” role. Mesh and peer-to-peer applications– there is no “client” and “AP” role. The PSK mode of 802.11i’s security is fundamentally broken. This is a source of continued bad press for 802.11– “802.11 is still not secure”. This deficiency has resulted in another organization making a very complicated, but still not-quite secure, adjunct to 802.11i PSK mode. Dan Harkins, Aruba Networks

May 2009 What’s The Problem? The security of 802.11 is centralized and role-based but 802.11 is being used in ways that are neither. If your deployment does not fall into a narrow use case your choices are cumbersome and difficult to deploy, or insecure. The mandatory-to-implement cipher—CCMP– is slow(ish), has rigid usage requirements outside of which all security is lost, and consumes more power than other modes providing comparable security. GCM mode is suitable for very high-throughput PHYs and requires less power than CCMP SIV mode provides provable security when adherence to the rigid usage requirements of CCMP cannot be guaranteed. 802.11 does not have a way to accept featurettes into the standard. Dan Harkins, Aruba Networks

May 2009 What’s The Solution? A Study Group to come up with a PAR & 5C to work on: Secure, de-centralized authentication and key management. These solutions should be suitable for a traditional ESS as well as ad hoc, mesh, and various peer-to-peer applications. They should not have strict role requirements. A password-based key exchange resistant to passive attack, active attack and dictionary attack. A certificate-based key exchange Definition (not development) of new ciphers AES-GCM: a high-performance, single-pass, cipher for authenticated encryption AES-SIV: a misuse-resistant cipher for authenticated encryption Dan Harkins, Aruba Networks

A Focus on Enhanced Security May 2009 A Focus on Enhanced Security Tight focus ensures timely results Keep a focus on security enhancements to existing 802.11 functionality and not creation of new security algorithms, ciphers, etc. Much of this has already been designed– GCM, SIV, SAE– so it’s a problem of defining use in 802.11. There is a need for de-centralized security in 802.11 Use of a PSK/password is widespread and will remain so. Unfortunately it is not secure; we should make it so. There is market demand, as shown by the work of other groups like WFA. It makes sense for 802.11 to provide it instead of hoping other organizations do it (and do it right). Data rates keep increasing, ciphers cannot be bottlenecks! More efficient ciphers consume less power which results in longer battery life, and it’s also green. Do security work in a security group; keep experts focused on their area of expertise. Dan Harkins, Aruba Networks

May 2009 References NIST SP800-38D P. Rogaway and T. Shrimpton, “Deterministic Authenticated Encryption, A Provable Security Treatment of the Key-Wrap Problem”, Advances in Cryptology– EUROCRYPT ’06, St. Petersburg, Russia, 2006. RFC 5297 H. Krawczyk, ‘SKEME: A Versatile Secure Key Exchange Mechanism for the Internet’, Proceedings of the Internet Society Symposium on Network and Distributed Systems Security, August 1995 V. Shoup, “On Formal Models for Secure Key Exchange”. ACM Computer and Communications Security Conference, 1999. Dan Harkins, Aruba Networks

May 2009 Motion Move to request the 802.11 Working Group to approve and forward to the IEEE 802 Executive Committee the creation of a new IEEE 802.11 Study Group, called the Enhanced 802.11 Security Study Group (ESSG), to investigate ways to provide security enhancements to 802.11 on the following: Secure, robust, de-centralized key management using public key-based and password-based credentials. Faster, more robust, or more power-efficient ciphers to protect 802.11 frames. Upon confirmation of feasibility and per 802 operating rules, the ESSG shall draft a PAR and 5 criteria to be submitted to the 802.11 WG. Moved: Seconded: Yes: No: Abstain: Dan Harkins, Aruba Networks