1. 無線區域網路安全 Wireless LAN Security

2. 2 Outline  Wireless LAN – 802.11b  Security Mechanisms in 802.11b  Security Problems in 802.11b  Solutions for 802.11b Security Problems –TKIP –802.1X –802.11i

3. 3 Wireless LAN – 802.11b  802 Family - Standard for Local and Metropolitan Area Networks –802.3: CSMA/CD Access Method –802.15: Wireless Personal Area Networks –802.11: Wireless LAN (CSMA/CA) 802.11b: 2.4 GHz, 11 Mbps 802.11a: 5 GHz, 54 Mbps 802.11g: 2.4 GHz, 54 Mbps 802.11i: Extended security –802.16: Broadband Wireless Metropolitan Area Networks –802.1X: Port-Based Network Access Control

4. 4 Wireless LAN – 802.11b  802.11b Architecture –Ad Hoc Mode –Infrastructure Mode STA STA: Wireless Station AP: Access Point AP Wired Network

5. 5 Security Mechanisms in 802.11b  Authentication –Open system authentication –Closed system authentication –Shared-key authentication  Confidentiality –WEP (Wired Equivalent Privacy)  Integrity –CRC checksum

6. 6 Authentication in 802.11b (1)  SSID: Service Set ID  Only correct SSID can access AP  Open system authentication –Respond correct SSID for null SSID –e.g. Windows XP STA AP Auth. Request (null SSID) SSID

7. 7 Authentication in 802.11b (2)  Closed system authentication –Users need to provide correct SSID –Attackers can intercept a transmitted SSID STA AP SSID Attacker SSID

8. 8 Authentication in 802.11b (3)  Shared-key authentication STA AP Auth. Request 128-bit challenge (R) K Response WEP K (R) Accept or Reject K Encrypt WEP K (R) Decrypt WEP K (R)

9. 9 Confidentiality and Integrity in 802.11b  Confidentiality - WEP (Wired Equivalent Privacy)  Integrity - CRC checksum STA AP K (40/104) K (40/104) message CRCmessage RC4 CRC IV  K IV (24) RC4  CRCmessage K IV (24) ciphertext

10. 10 Security Problems in 802.11b  Authentication –SSID authentication is ineffective –Shared-key authentication only provides one- way authentication, it is vulnerable to the man- in-the-middle attack. STA Real AP Auth. Request challenge R K WEP K (R) K Fake AP/STA Reject Auth. Request challenge R WEP K (R) Accept

11. 11 Security Problems in 802.11b  WEP –Short IV length leads to repeated IVs –Known Plaintext Attack RC4 IV  K IV (24) PC S P 1  S = C 1 P 2  S = C 2 P 1  P 2 = C 1  C 2 If P 1 is known  P 2

12. 12 Security Problems in 802.11b  WEP –Weak keys in RC4 [FMS01] –Known IV attack on RC4 RC4 IV  K (40) IV (24) PC S IV(1) IV(2) IV(3) K(1) K(2) K(3) K(4) K(5) Tools for this attack: - AirsnortAirsnort - WEPCrackWEPCrack

13. 13 Security Problems in 802.11b  CRC checksum –CRC-32 is linear i.e. CRC(A  B) = CRC(A)  CRC(B) [CRC(M 1 )||M 1 ]  S = C 1 [CRC(M 2 )||M 2 ]  C 1 = C 2 C 2 = [CRC(M 1 )||M 1 ]  S  [CRC(M 2 )||M 2 ] C 2  S = [CRC(M 1 )||M 1 ]  [CRC(M 2 )||M 2 ] = [CRC(M 1 )  CRC(M 2 )]||[M 1  M 2 ] = [CRC(M 1  M 2 )]||[M 1  M 2 ]

14. 14 Solutions 802.11b 802.11i WAPI WPA 1997June 2004  WPA – Wi-Fi (Wireless Fidelity) Protected Access –developed by the Wi-Fi Alliance with IEEE –an interim software-based security upgrade for 802.11b  Two primary security enhancements in WPA –TKIP (Temporal Key Integrity Protocol) for data encryption –802.1X for User authentication Mar. 2003

15. 15 Solutions  802.11i –802.1X –CCMP (Counter-Mode-CBC-MAC Protocol)  WAPI – WLAN Authentication and Privacy Infrastructure –WAI (WLAN Authentication Infrastructure) –WPI (WLAN Privacy Infrastructure)

16. 16 TKIP  TKIP adds three new algorithms to WEP: –A cryptographic message integrity code, or MIC, called Michael, to defeat forgeries; –A new IV sequencing discipline, to remove replay attacks; and –A per-packet key mixing function, to de- correlate the public IVs from weak keys.

17. 17 TKIP (Simplified) STA AP K 1 (128) message MICmessage RC4 Michael  RC4  MICmessage Per-Packet Key Mixing IV (48) K 2 (64) K 1 (128) Per-Packet Key Mixing

18. 18 802.1X  Port-Based Network Access Control

19. 19 802.1X  A framework for authentication and key management  Three entities in 802.1X –Supplicant (STA) –Authenticator (AP) –Authentication Server  Security conversation carried out between supplicant and authentication server  Authenticator acts as a pass through device

20. 20 802.1X Authenticator (Access Point) Supplicant(STA) Authentication Server EAP-messagesRADIUS-messages (Mutual) Authentication (/ Key Exchange) Accept or Reject

21. 21 EAP  Extensible Authentication Protocol (EAP) [RFC 3748] is just the transport protocol optimized for authentication, not the authentication method itselfRFC 3748  EAP is an authentication framework which supports multiple authentication methods.  EAP typically runs directly over data link layers such as Point-to-Point Protocol (PPP) or IEEE 802, without requiring IP. –EAP provides its own support for duplicate elimination and retransmission, but is reliant on lower layer ordering guarantees. –Fragmentation is not supported within EAP itself; however, individual EAP methods may support this.

22. 22 RADIUS  Remote Authentication Dial-In User Service (RADIUS) is defined in [RFC2865], and was primarily used by ISPs who authenticated username and password before the user got authorized to use the ISP's network.RFC2865  802.1X does not specify what kind of back-end authentication server must be present, but RADIUS is the "de-facto" back-end authentication server used in 802.1X.  There are not many AAA protocols available, but both RADIUS and DIAMETER [RFC3588] (including their extensions) conform to full AAA support. AAA stands for Authentication, Authorization, and Accounting (IETF's AAA Working Group).RFC3588IETF's AAA Working Group

23. 23 Available Authentication Types with 802.1X  EAP-MD5  EAP-TLS  EAP-TTLS  EAP-LEAP

24. 24 EAP-MD5 (Message Digest 5)  Uses an MD5 hash of a username and password to create challenges and responses from supplicant to the authentication server  Does not provide mutual authentication; only allows the server to validate the client  Is the least secure EAP authentication type among others

25. 25 EAP-TLS (Transport Layer Security)  Used in certificate-based security environments  Provide mutual authentication –both the client and server mutually validating each other via certificates  EAP-TLS security comes at a high cost –because requires full PKI infrastructure support

26. 26 EAP-TTLS (Tunneled TLS)  An extension of EAP-TLS  Requires only server-side certificates  EAP-TTLS needs less effort for its administration –eliminating the need to configure certificates for each client  It still provide mutual authentication –using ordinary password-based credentials within TLS sessions

27. 27 EAP-LEAP (Lightweight EAP)  Developed by Cisco –used primarily in Cisco Wireless LAN devices  A password-based key exchange protocol –Provide mutual authentication –But vulnerable to dictionary attack

28. 28 CCMP in 802.11i K (128) MIC message CBC-AES IV (48) CBC-MAC ciphertext