Slashdot Mirror
"Fast Packet Keying" Improvements to WEP
Weedstock writes: "BBC Tech News has an article about the latest development in wireless networking security. It seems that RSA Security has improved the encryption system used by the protocol. Will this new update finally make wireless networking secure? You can also find a list of papers about wireless security issues here." RSA has a press release about their changes to WEP being accepted by the 802.11 committee.
http://slashdot.org/article.pl?sid=01/12/17/185320 6&mode=thread
Jan
My own view is simple; encryption shouldn't be done at the hardware layer. Assume that everything on the network is wide open and use SSH / SSL on each protocol or an encrypted VPN.
:)
This way you can be sure everything is encrypted consistently from the host machine all the way to the client, even when your packets pass through 'unknown' equipment.
The other advantage of this approach is that you can get all your hardware cheap on ebay because everyone else is abandoning them as 'not secure enough'
455fe10422ca29c4933f95052b792ab2
Yes, I know, perhaps it's stupid of me, and I'm planning to set up some kind of security. But for many users out there - the people who wanna be able to check their email from the kitchen - weak security is just not a problem. Just so long as the spooks don't start wanting wireless access... :D
Pain(n): when you're telnetting into a box doing somethin cool, and some luser calls for help with a 'critical error' ad
old news
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
Just use a form of VPN to get your security over a wireless network. Remember, ethernet isn't secure either.
It is probably better to use your own encryption tools anyway, since built-in schemes will likely be obsoleted eventually.
IPSec is what I'm planning to use to make my future wireless LAN be secure.
Old 486 laptop with broken screen + OpenBSD + some 802.11 card = "no kids breaking into your network via wireless" for under $100.
Can I get this for my Linksys hardware in a firmware update?
IPSec solves this problem. And the much more common of someone plugging into a wire or hub between point A and point B. And the man-in-the-middle problem, for some networks. For some reason people seem to think it'l only work with IPv6 but it works fine with IPv4. You don't need to pay extra for a card that supports >40 bit encryption, either. All you need is an OS that supports it. Even Microsoft supports IPSec these days. Why are people still worrying about 802.11-level encryption when true end-to-end encryption is better and cheaper?
Offtopic, but here is a link for a project to attempt converting 2.4 GHz 802.11b wireless LAN cards down to the 900 MHz band to help overcome non line-of-sight issues.
here's the link
This article has been out for a while. move on, nothing to see here. You're probably gonna have to complain to get your 802.11 wireless lan cards updated.
The press releases are designed to soothe security-minded corporate customers and disguise the remaining technical issues with WEP, such as
1. the key-mixing technique was diluted in strength so that the overhead of firmware upgrades would be acceptable. The "improved" technique has been changed a few times as weaknesses were discovered. It is quite possible that the new WEP can be cracked as thoroughly as the original.
2. the key-mixing technique requires that a new temporal key be set up every 16K packets - a sign of weakness. The 802.1X procedures for setting up the temporal keys have not been finalized and contain weaknesses.
3. it is debateable whether the 802.1X temporal key procedures, once finalized, will be practical at higher PHY rates of 802.11g or 802.11a since the rate of temporal key updates must be greater than the lower rates needed for 11b.
It is more foolproof to rely on IPSEC as other posters observe. The argument against IPSEC and for wireless link crypto is based on the perceived overhead of forcing everything on an internal enterprise network to run IPSEC so that the wireless subnet can be secure. For SOHO setups this should not be an issue.
Comment removed based on user account deletion
not unless it's a firmware update that fixes all current equipment. There is alot of 802.11b stuff out there. much of it is 24-40 bit only. Most everyone using it hasn't a clue about firmware updates or even security problems for that matter (The sheer number of open 802.11b networks I can snif that have no encryption is proof of that.
They need to make this a part of the driver and make the driver force a firmware update and enable it by default if securing wireless is important. Otherwise this is only an expected feature of the new stuff that I'll buy in about 2-3 years.
Do not look at laser with remaining good eye.
I wonder... The press release quotes a PhD from Hifn and a marketing droid from RSA, and says that RSA and Hifn developed this together.
I know RSA's the big name here, but I wonder whether they merely contributed the name, not the research.
-Billy
Rotating the keys quickly will not solve the only problems with WEP. In general, encrypting stuff isn't enough. The receiver of encrypted data must insure that the data was not changed in route. Since the packet validator in WEP is CRC rather than something cryptographically strong, it is possible to perform replay attacks, or even worse, replay modified packets and have them be received as if they were legitimate. Even if it is not possible to decrypt packets, the ability to modify and reinject packets and have them be received creates some big problems.
I rather enjoy going to colleges' student centers and reading everyone's email. Hope this won't change my ways.
How about using private/public key cryptography? A randomly-generated private/public keypair can be blown into WiFi cards during manufacturing. When a card hops onto a network, it exchanges public keys with all devices on the network, and seamlessly encrypts all data to that device with the appropriate key. Make it built right in and mandatory. (The size of the key and selection of the algorigthm are left as an exercise for the reader.)
Already implemented in Cisco's newest firmware, acu and drivers (both Linux and Windows). Since the old firmware wasn't even vulnevable to airsnort unless there were VERY determined hackers out there Cisco gear hasn't been vulnerable at all. With the new firmware they also implemented per packet hashing so spoof attacks are foiled.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
- every card knows every other card's public key, so the storage requirement grows polynomially with the size of the network (not good).
- key exchange is a non-trivial step; in order to have adequate security you need to protect against man-in-the-middle attacks.
- using fixed keys is probably not so smart, since recovering the device would mean that you could decode all messages previously sent to that device, and a device with a compromised key could never be used securely again.
You're pretty sad, even I have better things to do...
Not true, we have a PS2, and we don't have a special remote, and we watched a movie on the conslole it last night using an ordinary dual shock controller that came with the system. It's also documented in the manual. I think this author may be thinking about the Xbox, but I don't have one of those.
My playstation may have a more recent firmware than the author's, we bought it this Christmas. I notice you can view version info when you boot it. Does anyone else have a PS2 that does this?
Too busy staying alive... ~ R.A.
I bet I can key your car faster than these packets can.
The real problem with WEP isn't the weak method it uses to generate RC4 keys. I've seen with my own eyes many networks that don't even have encryption enabled.
:-)
The real problem is that encryption is:
A. Optional.
B. Difficult to set up.
WEP isn't close to being "wire equivalent" because wires are, by default, pretty secure. You don't need to manually enable 'no-public-hub-ports-on-external-walls' mode with a wired Ethernet.
A wire isn't just a way to get the bits from A to B - it also acts as a user interface for associating machines with networks. I bet you didn't think of the patch panel in the server room as a user interface, right? Actually, it's a pretty good user interface. It's much more intuitive than any GUI and very reliable (ok, so it's a little messy, but so is my desktop
Here's an idea for how WEP could have been much closer to 'wired equivalent':
When you set up the device on your machine it scans for available networks and shows a list. You choose one. It then tells you to press a key at the same time as pressing a button on the access point.
If you have physical access to the access point you can do it yourself. Otherwise you call the admin on the phone and after checking your identity (usually it's just a matter of recognizing your voice) the admin tells you to press the key '...now!'. That's it. You're on the network, with securely configured strong encryption.
This can be much more secure that it appears - the key is exchanged using Diffie-Hellman key exchange so eavesdropping is not possible. Man-in-the-middle attacks are difficult in a shared medium such as wireless where everyone hears everyone else: if the two participants are careful they can detect such attacks. To prevent attempts to 'take a ride' and join the network at the same time as another machine the access point will verify that there are no other attempts to join the network within a certain period before or after the time window for 'simultaneous' button presses (actually within plus or minus a few hundred milliseconds).
Now, what are the chances of some company actually implementing this?
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
Of course, aside from the completely bone headed reuse of RC4 keystream, the actual Hard Problem is key distribution. Why the 802.11 guys want to revinvent this is a complete mystery to me. IPsec has IKE -- which is about to get a face lift in the form of either JFK, IKEv2 or most likley a combination of these proposals. IPsec also has KINK (Kerberized IPsec) which is about to go to last call. Eventually, I expect that AAA (DIAMETER) based IPsec keying will be formalized since they're already toeing that line in many areas.
Yet, the 802.11 folks still want to roll their own. Ick. How this will all play out with fast mobility (ie so you can run voip instead of circuit switched voice on CDMA/802.11 dual mode phones that will eventually appear) will be very interesting. My guess is that it won't until somebody takes an integrated look at security, quality of service, admission control, etc. I have some hope that the IETF protocols will eventually get this right, but the best I can hope for the L2 folks is that we can turn all of this krufty L2 wheel-reinvention off.
"fast packet rekeying" is not the same as changing the base keys or master keys (knowledge shared by the endpoints and key distribution system).
Rather, it refers to a technique of using regular
'ol WEP to encipher each packet, but using a different key FOR EACH PACKET. These per-packet keys are computed on the fly using a hash function-like method that scrambles the real key and thus increases the difficulty of attacking the underlying RC4. This technique has been called "key mixing" - a better term than "fast packet rekeying" IMHO - because it avoids confusion with "rekeying" whereby key material is exchanged between endpoints. Rekeying every 16K packets is required in addition to key mixing in order to avoid the passive key recovery methods (airsnort).
By the way, the "real" problem with RC4/WEP is that WEP uses the initial 256 bytes of the RC4 cipherstream. The best "fix" for WEP would be to simply discard all the key flogging trickery, but that approach was rejected because of overhead and difficulty of retrofitting NIC cards that have dedicated RC4 hardware.
It should also be pointed out that spiffing up the WEP does not eliminate attacks whereby 3rd parties inject messages. The rest of the fixup work for WEP involves specifying a separate message authentication function that prevents imposters from sending messages. A good example of what can happen in the absence of authentication is the recent well-publicized weaknesses in Universal Plug and Play. One problem was that an unsolicited UPNP NOTIFY message, if bogus and accepted, initiated a bad chain of events.
Similarly, a rekeying procedure using something like 802.1X is vulnerable to hijacking if the rekey messages are not protected with an authentication function. The bad guy can, in theory, instruct the endpoints to switch to a new key. Of course it's not quite as easy as that because the messages may not be easily forgeable. But if there are ways to forge such messages and there is no authentication function, then the system is wide open.
There is a fair chance that 11b vendors will subset WEP updates in a manner that will may separate message authentication as a configurable option. The result will be a better WEP, but in a system context that can still be compromized although not as easily as before.
Why do you insist on poiting your inanity at +1? Do you think anyone really gives a shit?
I live on a dead-end court too. Two of my neighbors have open 802.11 networks. If I didn't need a static IP address I'd consider dropping my DSL and using theirs; with connection bonding I'd get faster downloads than either of them ;-)