1. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 1 TGi Frame Exchanges Tim Moore Microsoft Pejman Roshan Nancy Cam-Winget Cisco Systems, Inc

2. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 2 Phase 1 – Finding and Associating to an AP Client AP Probe Request Probe Response + SSN IE (AP supports MCast/Ucast: WEP, TKIP and Auth: Dynamic Keys with 802.1X) 802.11 Open Authentication 802.11 Open Auth (success) Association Req + SSN IE (Client requests TKIP and dynamic keys with 802.1X) Association Response (success) 802.1X controlled port blocked for client AID

3. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 3 Phase 2 – Authenticating the User 802.1X/EAP-Request Identity Client AP AAA 802.1X/EAP-Response Identity (EAP type specific) RADIUS Access Request/Identity EAP type specific mutual authentication Derive Pairwise Master Key (PMK) RADIUS ACCEPT (with PMK via MS-MPPE) 802.1X/EAP-SUCCESS Derive Pairwise Master Key (PMK) 802.1X controlled port still blocked for client AID

4. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 4 Deriving the Pairwise (Unicast) Keys SNonce – Supplicant or STA Nonce ANonce – Authenticator or AP Nonce STA and AP must have a master key (PMK or PSK)

5. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 5 The Pairwise Key Hierarchy PRF-512 PMKString “Pairwise Key Expansion” Min(STA MAC, AP MAC) || Max(STA MAC, AP MAC) || SNonce || ANonce 512 bit Pairwise Transient Key (PTK) NOTE: Values are concatenated, so order matters

6. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 6 The Pairwise Key Hierarchy EAPoL-Key MIC Key 128 bits 512 bit Pairwise Transient Key (PTK) EAPoL-Key Encryption Key 128 bits Temporal Encryption Key 128 bits Temporal AP Tx MIC Key 64 bits Temporal AP Rx MIC Key 64 bits Bits 0-127Bits 128-255Bits 256-383Bits 384-447Bits 447-511 NOTE: The Tx MIC key is used by the station with the lower MAC address value The Rx MIC key is used by the station with the higher MAC address value

7. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 7 Phase 3 – The Four Way Handshake Client AP EAPoL-Key(Reply Required, Unicast, ANonce) PMK Derive ANonceDerive SNonce EAPoL-Key(Unicast, SNonce, MIC, STA SSN IE) EAPoL-Key(Reply Required, Install PTK, Unicast, ANonce, MIC, AP SSN IE) Derive PTK EAPoL-Key(Unicast, ANonce, MIC) Install Keys * Fields not noted are null 802.1X controlled port still blocked for client AID

8. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 8 Deriving the Group Keys Group Master Key Generation –Derived from a random number –Set to the first PMK (Optional, but not recommended) Must be updated periodically from another PMK Must be updated when the PMK source STA’s association state is purged. GNonce – Group nonce generated by AP

9. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 9 The Group Key Hierarchy PRF-256 GMKString “Group Key Expansion”AP MAC || GNonce 256 bit Group Transient Key (GTK) NOTE: Values are concatenated, so order matters

10. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 10 The Group Key Hierarchy 256 bit Group Transient Key (GTK) Temporal Encryption Key 128 bits Temporal AP Tx MIC Key 64 bits Temporal AP Rx MIC Key 64 bits Bits 0-127Bits 128-191Bits 192-255 NOTE: The Tx MIC key is used by the station with the lower MAC address value The Rx MIC key is used by the station with the higher MAC address value

11. doc.: IEEE 802.11-02/551r0 Submission September 2002 Moore, Roshan, Cam-WingetSlide 11 Phase 4 – The Group Key Update Client AP EAPoL-Key(All Keys Installed, Reply Required, Group Rx, Key Index, Group, GNonce, MIC, GTK) GMK Derive GNonce EAPoL-Key(Group, MIC) Derive GTK * Fields not noted are null Encrypt GTK field Decrypt GTK field 802.1X controlled port unblocked for client AID