Enhanced Security Features for 802.11 March 2009 doc.: IEEE 802.11-09/0000r0 March 2009 Enhanced Security Features for 802.11 Date: 2008-03-09 Authors: Dan Harkins, Aruba Networks Dan Hakrins, Aruba Networks

March 2009 doc.: IEEE 802.11-09/0000r0 March 2009 Abstract This document describes important security features that are missing from, or will enhance, IEEE 802.11. Dan Harkins, Aruba Networks Dan Hakrins, Aruba Networks

802.11 Security Services Authentication March 2009 802.11 Security Services Authentication A STA can prove its identity to the network and vice versa Authorization and Access Control Once authenticated a STA can be given access to the network, or a subset of it, or denied access to the network. Data Confidentiality Data sent between the STA and AP is hidden from all but the source and destination of the data. Data Integrity The recipient of a frame is able to verify that the frame was not modified in transit and that a false frame has not been substituted for a valid frame. Data Source Authentication The recipient of a frame is able to ascertain the origin of the frame and it is not possible for anyone else to masquerade as the claimed originator. Dan Harkins, Aruba Networks

How are These Services Provided Today? March 2009 How are These Services Provided Today? WEP Deprecated but still part of the standard. Intended to provide authentication, access control, and confidentiality but does not do so securely. RSN 802.1x Key Management: provides mutual authentication, allows for authorization and access control decision making, generates secure and cryptographically strong keys. PSK Key Management: provides a limited type of authentication, generates weak keys that void some features of RSN ciphers. TKIP: provides confidentiality, data integrity (sub-optimally), and data source authentication. CCMP: provides confidentiality, data integrity, and data source authentication. Dan Harkins, Aruba Networks

March 2009 What’s The Problem? Cryptographically strong security is limited to certain use cases. Not every deployment has a centralized AAA server; access to a centralized AAA server cannot always be guaranteed. Hence the WFA’s attempt to generate an adjunct for password-based authentication. Hence different use cases– peer-to-peer and mesh, for instance,-- developing their own way of providing security. Cryptographically strong security doesn’t really work for IBSS or peer-to-peer deployments. New ciphers that are arguable better than those currently defined in 802.11 have been developed. Unfortunately 802.11 lacks a definition on how to use them. Some TGs require security for features but such work is outside the scope of existing TGs. Dan Harkins, Aruba Networks

What’s The Solution? A new Task Group to work on March 2009 What’s The Solution? A new Task Group to work on Secure, de-centralized authentication and key management. These solutions should be suitable for a traditional ESS as well as ad hoc, mesh, and various peer-to-peer applications. A password-based key exchange resistant to passive attack, active attack and dictionary attack. A certificate-based key exchange Definition (not development) of new ciphers AES-GCM: a high-performance, single-pass, cipher for authenticated encryption AES-SIV: a misuse-resistant cipher for authenticated encryption Solution to current problems that are outside the scope of existing TGs TGv’s location services Dan Harkins, Aruba Networks

Secure, De-centralized Authentication March 2009 Secure, De-centralized Authentication Requirements Each device has its own authentication credential, a password or a certificate. Each device can authenticate another device without external assistance. Protocols must be defined in a peer-to-peer fashion. Peer-to-peer implies client-server, but the opposite is not true, so a peer-to-peer protocol would cover ESS, ad hoc, mesh, etc. Examples The password-authenticated key exchange in 802.11s: SAE. SKEME, a certificate-based authenticated key exchange protocol DHKE-1, a certificate-based authenticated key exchange protocol Dan Harkins, Aruba Networks

Support for New Ciphers March 2009 Support for New Ciphers AES-GCM Like CCM, GCM performs authenticated encryption and accepts additional authenticated data. GCM performs authenticated encryption with one pass over the data. This allows for much higher throughput that CCM which requires two passes. AES-SIV Like CCM, SIV performs authenticated encryption and accepts additional authenticated data. Unlike CCM, SIV will not lose all security if a nonce/counter is reused. This allows for more robust security, especially when the operations are taking place in software or in situations where uniqueness of counters cannot be strictly guaranteed. Dan Harkins, Aruba Networks

Address Issues Outside Other TG’s Scope March 2009 Address Issues Outside Other TG’s Scope TGv’s location services A STA wants to protect announcements it sends out pertaining to its location and these announcements are be received by multiple APs, some of which the STA does not share an active security association. Anything else? Dan Harkins, Aruba Networks

A New Task Group Tight focus ensures timely results March 2009 A New Task Group Tight focus ensures timely results Keep a focus on security enhancements to existing 802.11 functionality and not creation of new security algorithms, ciphers, etc. Much of this has already been designed– GCM, SIV, SAE– so it’s a problem of defining use in 802.11. There is a need for de-centralized security in 802.11 Use of a PSK/password is widespread and will remain so. Unfortunately it is not secure; we should make it so. Other groups– like Wi-Fi Alliance– believe there is market demand. It makes sense for 802.11 to provide it instead of hoping other organizations do it (and do it right). Data rates keep increasing, ciphers cannot be bottlenecks! Dan Harkins, Aruba Networks

March 2009 References NIST SP800-38D P. Rogaway and T. Shrimpton, “Deterministic Authenticated Encryption, A Provable Security Treatment of the Key-Wrap Problem”, Advances in Cryptology– EUROCRYPT ’06, St. Petersburg, Russia, 2006. RFC 5297 H. Krawczyk, ‘SKEME: A Versatile Secure Key Exchange Mechanism for the Internet’, Proceedings of the Internet Society Symposium on Network and Distributed Systems Security, August 1995 V. Shoup, “On Formal Models for Secure Key Exchange”. ACM Computer and Communications Security Conference, 1999. Dan Harkins, Aruba Networks

March 2009 Straw Poll “A Study Group to develop a PAR and Five Criteria for Enhanced Security for 802.11 should be created” Yes: No: Don’t Know, Need More Information: Don’t Care: Dan Harkins, Aruba Networks