Password Authenticated Key Exchange March 2008 doc.: IEEE 802.11-08/0045r3 March 2008 Password Authenticated Key Exchange Date: 2008-03-17 Authors: Dan Harkins, Aruba Networks Dan Harkins, Aruba Networks

March 2008 doc.: IEEE 802.11-08/0045r3 March 2008 Abstract A key exchange authenticated with a password (which may be cryptographically weak) is presented. Dan Harkins, Aruba Networks Dan Harkins, Aruba Networks

Pre-shared Key Authentication in 11s March 2008 Pre-shared Key Authentication in 11s Required for certain use cases. Current proposal is unrealistic Pre-shared key is assumed to be cryptographically strong Pre-shared key is pairwise. Pre-shared keys are deployed problematically for a reason Pairwise keys doesn’t scale: give an administrator a choice between O(n) and O(1) s/he will choose the latter. Pre-shared keys will be shared. Experience shows that things will be used insecurely if that’s easier to deploy that way. If n is a non-trivial amount (i.e. at least one-half dozen) the pre-shared key must be something that can be repeatedly entered with a low probability of errors– i.e. it probably won’t be cryptographically strong. Design of Key Hierarchy assumes root key is unique Sharing of pre-shared keys voids a fundamental security assumption The pre-shared key is used directly in the MSA 4-way handshake Dan Harkins, Aruba Networks

This Poses Severe Problems in a Mesh March 2008 This Poses Severe Problems in a Mesh Using the pre-shared key (or key trivially derived from pre-shared key) with MSA authentication is susceptible to attack. There are downloadable scripts available that can crack an 802.11i PSK in minutes! They could easily to the same for an 802.11s PSK The attack in 11s is far worse than the attack in 11i Attacking 802.11i PSK allows access to the network behind an AP for attackers within earshot of the AP. Attacking 802.11s PSK would allow the mesh to grow unbounded to unauthorized MPs and clients Successful attacks cause the mesh to grow, further increasing unauthorized traffic being sent onto the wired network behind the mesh. the larger the mesh the more opportunity for more attackers to see the mesh and attack it. It’s a vicious downward spiral. Uniqueness of mesh makes pre-shared key usage problematic A mesh introduces more opportunities for attack (more MPs!) than an infrastructure network Successful attack of one node compromises the mesh allows for exposure of prior traffic sent to/from the compromised MP and forgery of traffic to/from the compromised MP. Dan Harkins, Aruba Networks

March 2008 Mesh is used in a warehouse It gets attacked, mesh grows when unauthorized mesh point authenticates with the PSK. Bigger mesh is visible to more people who attack it, further growing the mesh …and it keeps growing as it keeps getting attacked. Dan Harkins, Aruba Networks

March 2008 How to Fix this Problem We need to ensure mesh security regardless of deployment. We need to ensure that the key used in the MSA 4-way handshake is unique and cryptographically strong. We cannot do that by issuing a fiat in the draft. We need a way to turn a cryptographically weak, and possibly shared, pre-shared secret into a unique and cryptographically strong key. This technique must be: Resistant to active attack Resistant to passive attack Resistant to dictionary attack We need to ensure that the technique used to generate a cryptographically strong key is appropriate for mesh. There cannot be any notion of an “initiator” and a “responder” We need simultaneous authentication of equals Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals A protocol for authentication and key derivation using a, presumably weak, pre-shared secret Initially both parties share: Knowledge of identity of self and each other’s identity-- “Alice” and “Bob”. A secret that need not be cryptographically strong– password. A public ordering function, L, that returns the “greater” of two strings A public random function, H The definition of a finite cyclic group. For an elliptic curve group Ε, base point is G, order is r. (Notation: a point is uppercase, Z, and a scalar is lowercase, z). A bijective function, F() that maps an element from the group to an integer. For an elliptic curve group, F() merely takes the x component of the point. For a prime modulus group the bijective function is the identity function. Upon completion: Peers are authenticated Peers share an authenticated (master) key that will be suitable for use with the Abbreviated Handshake. Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Uses 802.11 authentication frames for authentication! High-order bit of AuthAlg determines SAE when set and non-SAE authentication (there are 32762 remaining algorithms reserved) when clear. Remaining 15 bits of AuthAlg, when high-order bit is set, determine the finite cyclic group to use. The specific group is taken from a number-space managed by IANA for RFC2409 (IKE) “Diffie-Hellman groups”. There are approximately 35 different groups currently defined. See RFC5114 for the latest batch of group definitions. Such a construct allows for cryptographic agility without having to update the 802.11 standard each time a new group is defined. Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Assumptions Function H is a “random oracle”. An adversary is given access to a black box which upon input of data known to the adversary returns either random bits or the output of H. The adversary is unable to distinguish between the two and any advantage the adversary can gain is negligible and is solely through repeated interaction with the black box. For H: {0,1}*  {0,1}k each of the 2k possible outputs has an equal probability of being the output for some input. H is one-way. Given y = H(x) it is infeasible to determine x. The finite cyclic group is one for which the discrete logarithm problem is hard: given y = gx for some element of the group (the generator) g, it is infeasible to determine x. Equivalently for an elliptic curve group, given Y = x*G for some point on the curve (the generator) G, it is infeasible to determine x. Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Necessary to “fix” a password element in the finite cyclic group using the password. This is done once, when password is configured. For an elliptic curve group a random point is selected on the curve in a hunt-and-peck fashion. counter = 0 do { counter++; pwd-seed = H(password | counter) pwd-value = KDF(pwd-seed, “SAE Hunting and Pecking”) x = pwd-value y = solve_equation(curve, x) if (is_odd(pwd-seed) PWE = (x, -y) else PWE = (x,y) } while (!on_curve(PWE) For a prime modulus group the password element is fixed by hashing and exponentiation, where r is the order of the group. pwd-seed = H(password) pwe = pwd_seed ^ ((p-1)/r) mod p Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals if L(Alice, Bob) == Alice then q = H(Alice | Bob) else q = H(Bob | Alice) Z = q*PWE Alice Bob Choose random a, u A = -(u*Z), m = (a + u) mod r Choose random b, v B = -(v*Z), n = (b + v) mod r m,A n,B Compute K = a*(n*Z + B) = a*b*q*PWE Compute k = F(K) Compute x = H(k | A | m | B | n) Compute K = b*(m*Z + A) = b*a*q*PWE Compute k = F(K) Compute y = H(k | B | n | A | m) x y Verify y Verify x Authenticated Master Key = H(k | F(A+B) | (n+m)mod r) Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals This protocol can also be described using finite cyclic groups based on exponentiation modulus a prime. Such a group would have a generator g, a prime p, an optional order r, and exponentiation would be i = g^j mod p. A couple of caveats: The bijective function becomes trivial: F(x) = x. It will be eliminated from the description. If the order of the generator of the group, r, is not provided as part of the group definition it will be taken to be (p-1)/2. This will serve the purpose of effectively reducing the sum of the two random numbers while not changing the resulting computation of k. Fixing the password element is: pwd-seed = H(password) pwe = pwd-seed ((p-1)/r) mod p Dan Harkins, Aruba Networks

Backup m,A n,B x y Alice Bob Choose random b, v March 2008 Backup if L(Alice, Bob) == Alice then q = H(Alice | Bob ) else q = H(Bob | Alice ) z = pweq mod p Alice Bob Choose random a, u A = z -u mod p m = (a + u) mod r Choose random b, v B = z -v mod p n = (b + v) mod r m,A n,B Compute k = (zn mod p * B)a mod p = pweb*q*a mod p Compute x = H(k | A | m | B | n) Compute k = (zm mod p * A)b mod p = pwea*q*b mod p Compute y = H(k | B | n | A | m) x y Verify y Verify x Authenticated Master Key = H(k | (A+B) mod r | (n+m)mod r) Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Alice Bob Peer-to-peer protocol, not lock-step No notion of “initiator” and “responder”; “supplicant” and “authenticator” or “client” and “server”. Initial messages are not dependent on each other; final messages are dependent on initial messages, not each other. Each side can “initiate” or both can “initiate” simultaneously and the resulting protocol instances are identical Alice initiates first Bob initiates first Both initiate simultaneously Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Attractive security properties Perfect Forward Secrecy for keys. Key is authenticated in addition to the mesh points being authenticated. Resistant to active attack, passive attack, and dictionary attack. Uniquely appropriate for a mesh No roles– initiator/responder or supplicant/authenticator Either party can initiate first or both can initiate at the same time Addresses numerous comments: 1345, 1614, 1615, 1616, 1622, 2975, 2980, 4750*, and 4758, some of which were rejected out of lack of consensus on a solution. This can be that consensus. * my personal favorite. Dan Harkins, Aruba Networks

password authenticated March 2008 How to Fix this Problem pre-shared key Authentication Server (IEEE 802.1X Authentication only) cryptographically weak password authenticated key exchange cryptographically strong cryptographically strong PMK-MA AKCK and AKEK Temporal key (TK) Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals Running code! Implementation of SAE using 802.11 authentication frames per 11-08-0299-000s-password-authentication-for-mesh-points.doc. Three elliptic curve groups supported (trivial to add more) Implementation required modifications to madwifi driver to support the receiving and sending of 802.11 authentication frames. I plan on releasing a reference implementation as soon as I polish it up. Demo? Dan Harkins, Aruba Networks

Simultaneous Authentication of Equals March 2008 Simultaneous Authentication of Equals I’d like to make a motion! Instruct the editor to include the text from: 11-08-0299-00-000s-password-authentication-for-mesh-points.doc into the 11s draft. Dan Harkins, Aruba Networks