Link Setup Flow July 2011 Date: 2011-05-10 Authors: Name Company doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Link Setup Flow Date: 2011-05-10 Authors: Name Company Address Phone email Robert Moskowitz Verizon 15210 Sutherland, Oak Park, MI 48237, USA +1-248-928-6233 rgm@labs.htt-consult.com Slide 1 Robert Moskowitz, Verizon Page 1 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Abstract This document presents an approach for accelerating the security setup for FILS. It will also provide facilities for supporting acceleration of IP addressing. Slide 2 Robert Moskowitz, Verizon Page 2 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Agenda July 2011 Problem statement Solution overview Conclusions doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Agenda Problem statement Solution overview Conclusions Slide 3 Robert Moskowitz, Verizon Page 3 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Problem Statement July 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Problem Statement The majority of the packets needed for link setup are security related. Are there alternatives? Security is only provided for 'known' (authenticatable) clients Can we increase security deployment by supporting a 'TLS' anonymous client model? A number of use cases fit this model `Setup time MAY be further extended if Authentication Server is separate from the AP Can we authenticate the AP without an AS? Slide 4 Robert Moskowitz, Verizon Page 4 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Probe (1 round trip) 1/16 = 6.25% Authentication (1 round trip) 2/16 = 12.5% Association (1 round trip) EAPOL-Start EAPOL-Start (0.5round trip) Most of message exchanges are consumed for Authentication and Association. EAP-Identity (1 round trip) Establishing TLS tunnel for PEAP (3 round trip) 11/16 = 68.75% PEAP EAP-MSCHAPv2 (4 round trip) EAP-Success EAPOL-Success (0.5round trip) EAPOL-Key (2 round trip) 2/16=12.5% 2/16=12.5% Slide 5 Robert Moskowitz, Verizon Page 5 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Solution Overview July 2011 Providing a 'TLS' anonymous client model doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Solution Overview Providing a 'TLS' anonymous client model AP does not know 'who' the client is, but knows that it is always communicating with a given client AP does not authenticate client; relies on client to protect from MITM attack No AS needed by AP. Client validates AP via X.509 or raw Public Key 'white list'. No AS needed by client. AP and client only parties in a Key Management Protocol Slide 6 Robert Moskowitz, Verizon Page 6 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Solution Overview July 2011 Providing an authenticated client model doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Solution Overview Providing an authenticated client model AP does need to know 'who' the client is Client presents credentials to AP X.509 cert validated by AP or via OCSP No AS needed by AP (well maybe OCSP) Limited choices that are 'fast' Client validates AP via X.509 or raw Public Key 'white list'. No AS needed by client. May be hard to provide 'fast' solution or 'not so fast' Slide 7 Robert Moskowitz, Verizon Page 7 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Solution Overview July 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Solution Overview Use AUTHENTICATE frames to support Key Management Use a well-architected 2-party KMP between the AP and client Must have security integrity proofs Provide AP authentication to client Eg with X.509 cert Provide nonce exchange and generate both a PMK and PTK and transmit GTK No 4-Way-Handshake needed HIP or IKEv2 Slide 8 Robert Moskowitz, Verizon Page 8 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Protocol Sequence to Establish a Connection to the Internet by using Authentication and Association frames AP Authentication Probe [Auth server] STA HIP or IKEv2 (4 packets), optional As access Slide 9 Robert Moskowitz, Verizon Page 9 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Solution Overview July 2011 HIP or IKEv2 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 July 2011 Solution Overview HIP or IKEv2 Cryptographic and liveliness proofs of Identities Supports anonymous Identities Ephemeral 'raw' Public Key Authenticated delivery of X.509 certs uni or bi- directional Support for additional client authentication EAP, SAE, other Full nonce exchange for generation of PMK and PTK Secure transport of GTK Slide 10 Robert Moskowitz, Verizon Page 10 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT

Conclusions Thank you! May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 May 2011 doc.: IEEE 802.11-11/xxxxr0 May 2011 Conclusions Current KMP designs can replace 12 round trip current method with 2 round trips TLS anonymous model has no backend cost Significant reduction in cryptographic operations Thank you! Slide 11 Robert Moskowitz, Verizon Page 11 Konstantinos Georgantas, HIIT Konstantinos Georgantas, HIIT