Stefan Rommer, Mats Näslund, András Méhes (Ericsson) Month 2002 doc.: IEEE 802.11-02/xxxr0 July 2002 MIC’ for Public Access Stefan Rommer, Mats Näslund, András Méhes (Ericsson) S. Rommer, M. Näslund, A. Méhes (Ericsson) John Doe, His Company

Introduction Similar to 02/346 (was presented in Sydney). July 2002 Introduction Similar to 02/346 (was presented in Sydney). This presentation clarifies some aspects. Also: More people here this time Try to get to some conclusion S. Rommer, M. Näslund, A. Méhes (Ericsson)

General At public access sites: => Special security requirements July 2002 General At public access sites: APs placed in public spaces Anyone has access to premises People not trusted Charging for services => Special security requirements S. Rommer, M. Näslund, A. Méhes (Ericsson)

A hot-spot architecture July 2002 A hot-spot architecture Layer-2 LAN AP WLAN Support Node (WSN) STA Internet AP Untrusted Trusted (placed in locked room) S. Rommer, M. Näslund, A. Méhes (Ericsson)

Trust model In public wireless environments: July 2002 Trust model In public wireless environments: The wireless link is not trusted The AP is not trusted Someone can tamper with the AP. Tamper-proof APs not realistic. The AP-WSN link is not trusted Someone can insert a rogue AP or host. The WSN is trusted Placed in a locked room or off-site. S. Rommer, M. Näslund, A. Méhes (Ericsson)

July 2002 Security threats If someone can access the wired link between AP and the WLAN Support Node (WSN): An attacker may inject packets and interfere with billing (if billing is done in the in the WSN) An attacker may hijack a session An attacker may get free access If someone can tamper with the AP An attacker could reconfigure the AP Anything is possible S. Rommer, M. Näslund, A. Méhes (Ericsson)

July 2002 Proposed solution Integrity Protected STA AP WSN Integrity-protect all traffic between station and WSN. Add a MIC to each packet between STA and WSN. Will be transparent to the AP. Can be an add-on to the ”regular” 802.11i security. Re-use the existing key-management and possibly HW-functions in the STA. Key for extra MIC only known to STA and WSN S. Rommer, M. Näslund, A. Méhes (Ericsson)

Message flow 802.11i MIC’ ”Basic” 802.11i STA AP WSN Payload’ July 2002 Message flow 802.11i MIC’ ”Basic” 802.11i STA AP WSN Payload’ RC Payload MIC’ TAG Payload MIC’ Payload AES Encrypted IV Payload MIC’ Michael ICV TKIP Encrypted S. Rommer, M. Näslund, A. Méhes (Ericsson)

July 2002 Key details AP WSN PMK, PMK2 PMK2 PMK WSN acts as a RADIUS Proxy and can extract the Pairwise Master Key (PMK). A key for the new MIC can then be derived both at the Station and at the WSN. The WSN will then send a different key (PMK2) to the AP. PMK2 = h(PMK), where h = suitable one-way function. S. Rommer, M. Näslund, A. Méhes (Ericsson)

Simplified MSC AS STA AP WSN PMK2 PMK2 = h(PMK) h = one-way function July 2002 Simplified MSC AS STA AP WSN 802.11 association EAP-Request / Identity EAP-Response / Identity EAP message exchange Derive PMK Derive PMK RADIUS-Access Accept (PMK) Derive new PMK2 Derive new PMK2 RADIUS-Access Accept (PMK2) EAP-Success PMK2 PMK2 = h(PMK) h = one-way function PMK S. Rommer, M. Näslund, A. Méhes (Ericsson)

Why specify it in 802.11i? Light-weight (compared e.g. to IPSec) July 2002 Why specify it in 802.11i? Light-weight (compared e.g. to IPSec) Possible to reuse existing 802.11i functions, e.g. the key framework and crypto-HW. A single WLAN-solution will promote interoperability. S. Rommer, M. Näslund, A. Méhes (Ericsson)

Conclusion Possible solution for extra MIC: Straw poll: July 2002 Conclusion Possible solution for extra MIC: 802.11i-like key derivation MIC’ algorithm: e.g. MMH or AES-CBC-MAC The exact details to be worked out Straw poll: Is it of interest to TGi to have this kind of functionality in 802.11i? S. Rommer, M. Näslund, A. Méhes (Ericsson)

July 2002 Back-up slides S. Rommer, M. Näslund, A. Méhes (Ericsson)

Can we use the TKIP and WRAP MICs? July 2002 Can we use the TKIP and WRAP MICs? Split encryption and integrity protection between AP and WSN Encryption in AP Integrity protection in ASN Not a good solution Technical difficulties (see next slide) Good to keep an integrity check in the AP S. Rommer, M. Näslund, A. Méhes (Ericsson)

Can we use the TKIP and WRAP MICs? July 2002 Can we use the TKIP and WRAP MICs? TKIP MIC: The AP Transmitter Address is needed by the WSN TKIP Countermeasures AES-OCB tag: 802.11e Traffic Class input to integrity code Have to synchronize Replay Counters between AP and WSN AES-CBC-MAC MAC Header is included in integrity code Have to synchronize the Packet Number between AP and WSN CBC-MAC on MPDU level? => Fragmentation in WSN? Conclusion: WRAP MICs are closely tied to the 802.11 MAC layer. => Not a general solution, we need another MIC field. S. Rommer, M. Näslund, A. Méhes (Ericsson)