1. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. NETW 05A: APPLIED WIRELESS SECURITY Data-Link Security Solutions By Mohammad Shanehsaz Spring 2005

2. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Objectives Static and Dynamic WEP & TKIP Explain the functionality, strengths, and weaknesses of WEP and TKIP Explain appropriate scenarios and applications of static and dynamic WEP and TKIP Install and configure static and dynamic WEP & TKIP Illustrate feasibility of WEP exploitation Manage scalable WEP & TKIP solutions

3. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Objectives 802.1x and EAP Explain the functionality of 802.1x & EAP Explain dynamic key generation and rotation for solution scalability Explain the strengths, weaknesses, and appropriate applications of 802.1x & EAP Install and configure 802.1x & EAP, including LEAP, EAP-TLS, EAP-TTLS, EAP-MD5, PEAP, Manage scalable 802.1x and EAP solutions

4. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. 802.11 MAC Basics Management and control frames are sent in clear text and unauthenticated This is the basis for many types of attack scenarios For some types of attacks particular vendors have instituted proprietary solutions Many of these vulnerabilities will be addressed by the 802.11i standards

5. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Categories of Authentication & Encryption There are three main categories: Static WEP Dynamic WEP Proprietary protocols There are variations on each type

6. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Static WEP Security solution based on unchanging shared keys that are preconfigured on all nodes by network administrator Protects the wireless link with simple authentication and data encryption Not a complete solution, it can be cracked using common tools such as WEPcrack or Airsnort

7. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Cracking WEP Cracking WEP requires three things: Large number of captured packets Long periods of time to capture those packets Fast machine to process the information contained in the packets to derive the WEP key It can takes days to crack it, is it worth it ?

8. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. TKIP Temporal Key Integrity Protocol is a set of modifications to the existing WEP algorithm IEEE 802.11i task group created TKIP TKIP is a type of dynamic WEP solution where WEP keys are rotated on a changeable interval, but static WEP key is still used as keying material

9. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. WEP Weaknesses Addressed TKIP algorithms address the following weaknesses: Forgery Weak-Key attacks Collision attacks Replay attacks

10. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Forgery TKIP supports per-packet authentication Forgery attacks are performed by capturing encrypted packets, changing some data within them, and then resending the packets TKIP uses message-integrity check (MIC) called “Michael” to thwart attempts MICs add significant network overhead

11. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Weak Key Attacks WEP construct a per-packet RC4 key by concatenating an RC4 base key and 24 bits IV TKIP uses key-mixing to derive short–lived encryption keys TKIP uses 128 bit temporal key combined with the client’s MAC address and large 48 bit IVs to produce the key for encryption

12. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Collision and Replay attacks TKIP uses 48 bit IVs, which increases the possible number of IVs, to prevent collision attacks TKIP prevents replay attacks by using sequencing number for generated packets

13. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Availability For those products that are currently Wi-Fi certified, most can be upgraded to support TKIP, assuming the vendor has made a firmware upgrade available- check the web site for upgrades

14. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. 802.1x / EAP 802.1x with use of the Extensible Authentication Protocol implements what is generally referred to as dynamic WEP Dynamic Key Generation, Distribution, & Rotation EAP is a layer 2 authentication protocol replacing PAP and CHAP It is appropriate for medium to large enterprise environment Basing authentication on individualized user credentials such as usernames and passwords, certificates, smartcards and other like methods

15. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. 802.1x Standard IEEE standard that provides an authentication framework for 802-based LANs It was originally used in wired networks and has since been adapted for wireless networks It provides port-based access control so that before the switch or access point will establish a connection, the user credentials must be verified 802.1x standard addresses only access control and authentication framework and does not address data privacy, so that the problems with WEP still exist, EAP eliminates the problems through dynamic key generation

16. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. 802.1x Standard There are three terms defined by the IEEE standard that describe the devices used in 802.1x Supplicant-a client that is being authenticated Authenticator-an access layer device such as AP or bridge that requires supplicants to be authenticated in order to pass traffic through it Authentication server-( typically a RADIUS ) the device that is doing the authentication of the supplicant

17. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. 802.1x Standard Advantages Maturity & Interoperability User-based identification Dynamic Key Management Flexible Authentication

18. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Maturity & Interoperability The industry’s choice to use in WLAN because of time-proven use in wired network Supports of mature protocols such as EAP and RADIUS which are open standards providing max interoperability in centralized identification and key management

19. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. User-based Identification Basing authentication on actual user not a particular wireless device, on a scalable database such as RADIUS or other databases that RADIUS directly supports (Active Directory, NDS, LDAP, SQL) Centralized authentication and management save time and money

20. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Dynamic Key Management Per-user per-session keys eliminates attacks based on obtaining the WEP key Automated key management systems allow keys to be reissued without an administrator’s intervention

21. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Flexible Authentication There are several supported authentication solutions to choose from Changing the authentication mechanism does not require any hardware replacement

22. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP Protocol Provides an extensible method for PPP server to authenticate its clients EAP supports two-and three-factor authentication (passwords, certificates, biometrics, etc) EAP was designed to prevent proprietary authentication solutions from being implemented which would have had a negative effect on the interoperability and compatibility between systems EAP is within OS of the server or application software on the client Windows XP natively supports EAP

23. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP Authentication Types There are many EAP types : EAP-MD5 EAP-TLS LEAP EAP-TTLS PEAP

24. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-MD5 First Authentication type created by RFC2284 for 802.1x Uses the same challenges handshake protocol as PPP-based CHAP, except challenges and responses are sent as EAP messages It has three weaknesses: One-way authentication Challenge passwords No per-session WEP keys Rarely used because of its weaknesses

25. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-MD5 Weaknesses one-way Authentication Because only the supplicant gets authenticated, an impersonator could be added as rogue RADIUS server to obtain the login credentials of a legitimate user

26. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-MD5 Weaknesses Challenge Passwords Authentication server challenge the supplicant with a random string of text The supplicant hashes the challenge with its password and send it back The server validates the response based on its knowledge of the password Eavesdropper can obtain both the challenge and the hash, which he/she can break it with dictionary attack to obtain user’s password

27. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-MD5 Weaknesses no per-session WEP keys After authentication, communication is either not encrypted, or encrypted with a static WEP key Because of static WEP vulnerability, it allows eavesdropping on the data

28. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TLS (EAP-Transport Level Security ) Developed by Microsoft and standardized by Internet Engineering Task Force It is based on the secure socket layer protocol used for secure web traffic It uses both server-side and client-side certificates for user identification (mutual authentication) More appropriate for organizations that have already deployed a PKI (public key infrastructure) Per-session WEP key is set up, and client can be re- authenticated and re-keyed as often as needed without inconveniencing the end user

29. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. TLS Authentication The TLS process begins with the handshake process: 1. The SSL client connects to a server and makes an authentication request 2. The server sends its digital certificates to the client 3. The client verifies the certificate’s validity and digital signature 4. The server requests client-side authentication 5. The client sends its digital certificate to the server 6. The server verifies the certificate’s validity and digital signature 7. The encryption and message integrity schemes are negotiated 8. Application data is sent over encrypted tunnel via the record protocol

30. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TLS Authentication The EAP-TLS authentication process is as follows: 1. The client sends an EAP start message to the access point 2. The access point replies with an EAP Request Identity message 3. The client sends its network access identifier (NAI), which is username, to the access point in an EAP Response message 4. The access point forwards the NAI, encapsulated in a RADIUS Access Request message to the RADIUS server 5. The RADIUS server responds to the client with its digital certificate

31. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TLS Authentication 6. The client validates the RADIUS server’s digital certificate 7. The client replies to the RADIUS server with its digital certificate 8. The RADIUS server validates the client’s credentials against the client digital certificate 9. The client and RADIUS server derive encryption keys 10. The RADIUS server sends the access point a RADIUS ACCEPT message, including the client’s WEP key, indicating successful authentication 11. The access point sends the client an EAP Success message 12. The access point sends the broadcast key and key length to the client, encrypted with the client’s WEP key

32. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-Cisco Wireless (LEAP) Cisco’s proprietary Lightweight Extensible Authentication Protocol was designed to support 802.1x/EAP based authentication It was developed to support networks with a variety of OS that may not natively support EAP LEAP supports mutual authentication between a client and a RADIUS server LEAP provides user-based, centralized authentication as well as per-session WEP keys Used in Cisco’s Aironet products Its security level is considered moderate or strong based on the strength of the passwords used See figure 11.12 on page 256 for LEAP Process

33. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TTLS (Tunneled Transport Layer Security ) Was co-developed by Funk Software and Certicom, supported in Funk’s Odyssey software EAP-TTLS requires only an authentication server certificate TTLS uses TLS channel to exchange “attribute-value pairs” (AVPs) After authentication server is authenticated using its digital certificate, an encrypted tunnel is established between the supplicant and authentication server to pass the supplicant’s authentication credentials See figure 11.13 for EAP-TTLS Process

34. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Key security Features of EAP- TTLS Almost any kind of supplicant authentication credentials (passwords, tokens, etc ) can be used inside the encrypted tunnel Low overhead since requirement of only server-side certificate Many types of authentication algorithms may be used inside the encrypted tunnel-MS-CHAPv2, MS-CHAP, CHAP, PAP,EAP-MD5 Strong protection against eavesdroppers seeking to perform dictionary attack Mutual authentication, fast connections while roaming, and automatic re-keying of encryption keys

35. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Protected EAP ( PEAP ) PEAP was developed by Microsoft, Cisco and RSA Security to address deficiencies of EAP (Unprotected user information during the EAP negotiation, No support for fast reconnections when roaming, No support for fragmentation and reassembly) PEAP was designed to protect EAP communication between clients and authenticators It provides support for identity protection by using TLS to create an encrypted tunnel after verifying the identity of authentication server

36. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Protected EAP (PEAP) continue After encrypted tunnel is established a second EAP authorization process occurs inside the tunnel The client is authenticated inside the tunnel using any implemented EAP authorization type (tokens, passwords,etc) It has built-in support for packet fragmentation and reassembly, as well as fast reconnects See figure 11.15 on page 263 for PEAP process

37. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. PEAP Authentication 1. The client sends an EAP start message to the access point 2. The access point replies with an EAP Request Identity message 3. The client sends its network access identifier (NAI), which is its username, to the access point in an EAP Response message 4. The access point forwards the NAI to the RADIUS server encapsulated in a RADIUS Access Request message 5. The RADIUS server responds to the client with its digital certificate 6. The client validates the RADIUS server’s digital certificate

38. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. PEAP Authentication 7. The client and server negotiate and create an encrypted tunnel 8. This tunnel provides a secure data path for client authentication 9. Using the TLS Record protocol, a new EAP authentication is initiated by the RADIUS server 10. The exchange includes the transactions specific to the EAP type used for client authentication 11. The RADIUS server sends the access point a RADIUS ACCEPT message, including the client’s WEP key, indicating successful authentication

39. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TTLS vs PEAP Both were designed to use older authentication methods while maintaining the strong cryptographic foundation of TLS Both have similar structure Both are two-stage protocols that establish security in stage one and then exchange authentication in stage two Stage one establish a TLS tunnel and authenticates the authentication server to the client with a certificate

40. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP-TTLS vs PEAP Microsoft and Cisco both support PEAP Cisco’s Aironet Client Utility (ACU) and Windows XP with service pack1 There are two types of PEAP supported by Microsoft: PEAP-EAP-MS-CHAPv2 and PEAP-EAP-TLS PEAP-EAP-TLS, server and client side certificates are required PEAP-EAP-MS-CHAPv2, server certificates and client passwords are required

41. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. EAP Considerations The factors to include when deciding: Mutual Authentication Dynamic Key Generation, Rotation, and Distribution Cost and Management Overhead Acceptance, Standardization, and Support Availability and Implementation

42. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Proprietary Protocols These protocols are used because: Added security through per packet authentication Added security through use of leading-edge encryption algorithms not yet supported by standards Added security due to the entire communications process between client and server being strongly encrypted Compression to increase throughput over the half- duplex medium

43. This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Proprietary Protocols Enterprise Encryption Gateways use proprietary protocols in order to achieve stronger security and increased throughput, but the main disadvantage here is vendor interoperability