Security evaluation of 802.11i

Uberhacker.Com writes "Server Pipeline features an interesting report on the security viability of 802.11i. As most observers of the WLAN industry are aware, the security features found in the original standard were woefully inadequate. To a certain degree, these deficiencies reflected the perception that security services are normally implemented at layer 3 and above. 802.11i's privacy services are built on top of AES, a strong encryption standard that passes muster with even the most paranoid security administrators."

Comments

Except of course...

[Anonymous Coward]

...if the backdoor password is 12345

Re:Except of course...

[harrkev]

Somebody change the combination to my luggage!

Re:Except of course...

[Anonymous Coward]

amazing! i have the same combination on the giant plastic atmosphere on my planet, druidia!

Re:Except of course...

[Kjuib]

This gues knows what he is doing... his password would be 31337

Re:Except of course...

[Anonymous Coward]

no, actually, that joke was lame, and has been so ever since spaceballs came out.

Re:Except of course...

[Anonymous Coward]

For real securty change the username from 'super' with 'superman' and changed the password to 21241036

http://slashdot.org/articles/04/06/08/1319206.sh tm l?tid=126&tid=172

Re:Except of course...

[NanoGator]

"Darn. My comment IS funny if you read the parent. Unfortunately, the parent got modded into oblivion."

Sorry man, wasn't funny. Too obvious.

It's gonna cost me karma, but I thought you should know for the next time you tell a joke. ;)

Re:Except of course...

[myatmpinis1234]

I like your comment!
myatmpinis1234.blogspot.com

Re:Except of course...

[sharkey]

That's just too insecure. It should be a combination of letters, numbers and punctuation, such as:

aquaman-3176355959

Re:Except of course...

[Anonymous Coward]

Darn. My comment IS funny if you read the parent. Unfortunately, the parent got modded into oblivion.

Even lamer is complaining about how your post was moderated (thus winning a thoroughly deserved "-1 Redundant" moderation).

An intelligent poster would've quoted the original one-line joke before adding the new punchline.

What's the 'i' for?

[dkh2]

The 'i' is for insecure of course. What else could it possibly stand for?

Re:What's the 'i' for?

[Anonymous Coward]

If you have a linksys, that isn't neccessary... well, unless, of course, your roof is only 6 feet from the router, but even then, the cracker-to-be would have to be right up against your roof in order to get a 2mbps connection.

Re:What's the 'i' for?

[Anonymous Coward]

Nevertheless, given the past history of security related hw and sw (including hardened products like ssh and OpenBSD), I would bet good money that at least one hole will be found in this protocol within the next 5 years.

Once that happens, it will indeed be as insecure as its predecessors, and your name calling won't change that.

Re:What's the 'i' for?

[WeblionX]

Kind of like how inflammable means flammable, right?

Re:What's the 'i' for?

[BrokenStructure]

I'd rather have no sex than bad sex. ugh.

Re:What's the 'i' for?

[bonhomme_de_neige]

No, the i is to make the protocol more marketable and appealing to Mac users ;p

*ducks*

Security?

[MalaclypseTheYounger]

I line the interior of my house and roof with tin-foil, so I think my Wireless network should be pretty safe.

(obligatory post, sorry)

Re:Security?

[ZZeta]

You see, the more layers you have beneath, more layers your information goes unprotected.

For example, when the encryption is done in the upmost layer (Application Layer), that means that anyone sniffing your line could read your data.
That's why now-a-days most encryption is done in a hardware level.
This same line of though can be apply to wireless, wired, and mostly any kind of networking available.

It really is a big deal where the information gets encrypted.

Re:Security?

[surreal-maitland]

what you're missing is the fact that there's no such thing as perfect security. anything is hackable, though some things are very very extremely hard. thus, bearing this in mind, and wearing our tinfoil hats like good little children, we would like to secure the headers as well. if mr. malicious knows you're sending data to your credit card company, he'll be willing to work hard to find out what's inside. if he has to work hard to find out where you're sending the data, that's one more deterrent.

you don't have to be totally hack-proof, just moreso than any other potential target. :)

Re:Security?

[Frennzy]

It's not just a matter of data. It's a matter of Authentication, Accounting, and Authorization.

The real problem with WEP was with the init vector. It was trivially easy to crack, given enough packets. From that point forward, Joe Pr0n and Suzi Spammer were using YOUR bandwidth to do their nefarious deeds. Would you be happy when the FBI came to your door with a search warrant for kiddiepr0n?

What about those death threats to the prez that came from your IP? With your email address?

Re:Security?

[gedhrel]

Actually, in some scenarios the information exposed to traffic analysis may be critical. Whether those scenarios coincide with your average WLAN use is debatable; however, the intention is that WLAN should become a pervasive and persuasive technology for all your data needs (modulo high-energy physicists and geneticists), so some overlap is to be expected.

Have a look for "onion routing" to get a good idea of why people consider this to be important in general, and the extent of the effort you need to go to to obscure traffic form analysis.

Re:Security?

[Soko]

That's security through obsurity, really, isn't it?

AES et. al. means that noone can eavesdrop on your conversation - It's encrypted form end to end. That means if your talk to your bank via https over an AES secured connection, your connection is secured to thier web server at layer 2, while your passwords etc. - session data - are encrypted at layer 4.

That way, if someone does somehow break into your converstaion, the session data is still protected.

AES secures the physical layer, the other systems secure the actual conversation.

Soko

Re:Security?

[jaraco]

It has to do with applicability.

If you insist that security be applied at the application layer, you are insisting that all application programmers include security provisions in their software. And then, the security routines must go through peer review and analysis for at least a cursory inspection for vulnerabilities.

If you apply the security at the link layer, then you're securing a different thing. You're securing all communication across that link. There is an overwhelming desire to accomplish this in wireless transmission because of the inherent lack of control over the data path (since the transmission must be broadcast, anybody can communicate on the line).

Higher layer security is still necessary, but you need the lower layer security to avoid unwanted guests on the network.

Re:Security?

[chris_mahan]

yes, and for the very paranoid, the hardware encryption is the first line of defense. Then, the application layer is also encrypted. And for the very very paranoid, the data is obfurscated enough that the Username and Password are not sent on the same packets, and the passwords are salted and hashed (I'm hungry).

You can do even more... But this suffices as an example that hardware level encryption is not the last and final security feature that makes the world a better place. It's one of many.

Re:Security?

[beegle]

Actually, some kinds of data are -more- secure when they're only encrypted at a higher layer. If you know certain things about the encrypted data (like port numbers or hostnames or timestamps or the like), it's easier to do traffic analysis: you have some known plaintext to search for. If nothing else, you're providing more data for a brute-force attack.

Crypto 101: don't encrypt any redundant or easy-to-guess data. That's why PGP compresses data before encrypting it.In World War 2, the allies searched for the phrase "Heil Hitler" in encrypted German messages. It worked with surprising frequency. Many of the attacks against Kerberos 4 rely on excessive encryption: if you're sending a request from a specific host, it's kind of silly to encrypt the name of the host that's requesting a ticket. It's just one more bit of plaintext to search for. That's why Kerberos 5 moved more information to plaintext.

Re:Security?

[realnowhereman]

• Security through obsucrity - bad.
  
• Security and obscurity - good. /ul
  
  Who'd a thought it?
  

Re:Security?

[Waffle Iron]

Why is it that applying security at a higher layer is a bad thing?

Maybe it's because people don't want strangers connecting to the Internet through their wireless networks to leach bandwidth and engage in nefarious activities.

Re:Security?

[johnnyb]

The problem is that many networks and networking applications assume a reasonably secure LAN - i.e. - that someone can't arbitrarily walk up w/ a computer and plug in. That's not necessarily a good assumption, but it's one that is made.

It also forces anyone who wants to hack to be in the building - i.e. forces you to get through physical security. If you can work on hacking from a parking lot, you're pretty screwed.

In addition, many networks assume that the interior is trusted - that good guys are on the inside. Things are left open in order to make work go by faster (hence, the reason for computers), and wireless negates that assumption that is usually made w/ smaller businesses. Honestly, why would you lock down a business of 3-5 people. What help would it afford? In a business that small, everyone needs access to all data anyway, so extensive security measures are simply a burden.

Finally, wireless allows attackers to use your network as a launching pad for attacks on others. Even if they haven't hacked into your servers, they can use you as a launch point for attack.

It's a messy situation for system administrators.

Re:Security?

[silas_moeckel]

It's not realy security through obscurity. The encryption stops attackers from joining a wifi network besides protecting all data passing through it. Thats a big deal because passive sniffing is one thing active attacking is another. Once they can inject packets onto your network depending on design they have breached a layer of security (then there are those that treat there wifi like the inetnet and trust none of it)

Yup your L2 is secured and your L4 is as well when we get ipsec in place your l3 will also be secured.

It's all breakable it's just a question of time vs computing power. There is only one known unbreakable encryption method the one time pad (quantom encrypt is realy just pad generation and distribution with the added benifit of being tamper evident)

AES secures Layer 2, the physical layer might be secured via fairiday(sp?) cages, directional anetena's guys, guys with guns etc. But only the realy paranoid worry about that to much.

Overall is a good idea to secure each and every layer as it just adds to the ammount of computation required to decrypt what you want.

Re:Security?

[Cecil]

Some pretty substantial information can be gleaned from headers. You may not care that people know you're sending data to your credit card company. But some people do care. Any theoretical thief now knows what bank you use, for one thing. Someone with some amount of authority or social-engineering skills could go to the bank directly and corellate their logs with your traffic and find out exactly who you are. A physical thief could notice that you're visiting porn sites and decide that since you're probably not paying much attention to outside, now would be a good time to steal your car. These are contrived examples I admit, but given time, privacy is eroded greatly by such small loopholes.

To compare it to its non-internet equivalent, it is the difference between allowing everyone to see your phone records (anyone can look at where your packets are headed), and requiring a subpoena to disclose them to a court of law (subpoena the ISP or destination sites' logs). In neither case can they see or hear exactly what you said to the other end, but obviously the latter is much preferable for anyone interested in privacy.

Re:Security?

[egarland]

Also, if you can gain ethernet communications with a machine you can hack it. Even if you implement security at onther level (i.e. using a VPN over the wireless link) someone can hack into your machine and gain access to your machine and to the VPN through it. Security of wireless networks is quite important.

Re:Security?

[cynic10508]

Why is it that applying security at a higher layer is a bad thing? The data is what needs to be secured, not the headers of the packets... I don't care if people know I'm sending data to my credit card company, I do care if they know what my login and password is though... Am I missing something? Why is it so important to apply security to the lowest layer?

Traffic analysis is rather dangerous too. Imagine if your neighbors noticed that you were surfing www.sexuallytransmitteddiseases.info a lot...

Re:Security?

[Jahf]

There is definite advantage to hiding what packets are going where.

Extreme Example: I may check mail from a corporate mail server. My mail session is encrypted via SSL but you can still tell which server I am communicating with. Let us say someone knew that an employee of my company lives in my town, and they wanted to find out which house that employee (me) lived in so that they could start monitoring their physical mailbox for some important letter.

If they came to my town, which uses 802.11b WISPs which 1/2 of don't use encryption because WEP is so breakable (I wish they'd turn it on to protect from casual tapping, but oh well, at least my email is sent over SSL), they could drive around for a few minutes sniffing until they triangulated the signal that was sending packets to that corporate mail server.

Am I worried about this happening? Not so much, because I have a P.O. box :) and because I rarely get postal mail, but it is possible.

Additionally, many people don't have the ability to tunnel their unencrypted data (like port 80 web traffic) to obtain ubiqitous encryption over wireless. I personally think that is the next evolution of wireless routers (including easy but secure VPN services on the router itself which can be used in conjuction or in place of lower level encryption). But until it becomes easy for the masses having a strong, common low level encryption technology is key.

Re:Security?

[richard_willey]

I am a firm believer in "end-to-end" security models based on IPSec. With this said and done, there are a lot reason's why datalink layer security is desirable. Most notably, if I am relying solely on network layer or application layer security then by definition, I need to grant datalink layer access to my network before I can use the network layer to authenticate. Many folks consider this problematic.

Equally significant, suppose that I do exacly as you say and only encrypt application layer data while expose TCP and IP headers. This would allow individual to determine the specific protocols being used to exchange data and in turn, to use known plaintext attacks. I KNOW that a telnet session is going to start with some "IAC DO" and "IAC WILL's". I can make some guesses regarding what a file downloaded over HTTP is going to look like.

Re:Security?

[_Sharp'r_]

In most situations (where the admins and programmers aren't perfect), if you know what applications on what OSs are communicating to each other (in other words, you can just see the server and port information, along with a little more header info), then you can go find a vulnerability that affects one of those OS/application combinations that they haven't fixed/patched yet and crack into the system.

So broadcasting that info in the clear over the airwaves isn't the best idea for security.

Re:Security?

[DarkMantle]

Saves having to wear the tinfoil hat in the house!

Re:Security?

[Bishop]

That's security through obsurity

Please stop abuseing the phrase "security through obscurity." The catch phrase was meant to apply to one and only one case: The practive of obscuring encryption algorithms. Bruce Schneier's thesis was that an encryption system that relied on a secret or hidden algorithm was not secure. The phrase "security through obscurity" does not apply to anything else.

Some forms off security relies on obscurity. Encryption is just a fancy word for data obscurity. Passwords, secure tokens, and RSA private keys should all be kept hidden or obscured. It should not be to hard to think of many forms of physical and data security that include some form of obscurity.

One of the advantages to using encryption at the link layer is that it is harder to perform traffic analysis if an attacker can't determine the destination of the packet. Another advantage is access control. Only hosts that know the secret key can join the network. Both of these advantages are forms of security.

Re:Security?

[Methuseus]

umm, so are you agreeing with the parent post that obscurity isn't a bad thing as long as it's not the only form of security? or are you saying something different? I'm not sure I get it...

Re:Security?

[John Whitley]

That's security through obsurity, really, isn't it?

You fail to understand the security community's use of "security through obscurity." In its proper context, this phrase means that one attempts to secure (for example) an implementation of a security protocol by not disseminating information about how that system works. For example, if someone creates a new asymmetric encryption algorithm, and does not subject it to publication and the scrutiny of peer review... then that's security through obscurity. Security through obscurity, for topics like encryption algos, is heavily frowned upon. Historically, peer review has proven best able to create robust protocols and implementations.

Locking down multiple layers in the network stack has another phrase that is very applicable: "defense in depth". I.e. if one of your security measures fails, you are wholly or partially protected by one or more other security measures. Defense in depth is generally considered to be a good technique to employ.

Re:Security?

[rbk17]

The bad thing about having only higer layer security is that somebody can use your internet connection to upload kiddy-porn, send spam ...

Re:Security?

[maxhead]

Here's your answer: http://www.trapezenetworks.com/technology/whitepap ers/illusionofsecurity.asp

Re:Security?

[Mr Guy]

Security through obscurity isn't intrinsically bad. That's essentially how I keep people both out of my car and my home. How many tumbler combinations are there for the typical doorknob anyway?

Re:Security?

[Frizzle Fry]

I don't care if people know I'm sending data to my credit card company

Maybe you don't, but there are plently of us who would perfer not to broadcast with the world information about everyone with whom we communicate.

Re:Security?

[Anonymous Coward]

It's 'et al.', not 'et. al.'. Et is Latin for and; it's not an abbreviation.

Use your Latin correctly, or stick to English.

Re:Security?

[Anonymous Coward]

Because you're coming from a definition of "security" that is too narrow. If you don't have any integrity or assurance built in at a low level, if you don't take care to ensure availability, you don't have any security up top where your application lives. Also try to keep in mind that "applying" security at a high layer or level has implications that just this is happening at the design phase -- the security is nothing but an applique, the functionality itself is not built around a security model. So take that into consideration as context for security models where a more integral or "low level" approach is taken.

Re:Security?

[BrokenStructure]

I thought some of the point of this was to keep people from being able to steal bandwidth from your wlan connection by gaining access to it (and using it for god knows what). When I first installed my wi-fi network at home, I noticed my neighbor's connection. It was broadcasting its name with no wep encryption. Had I been a better bastard I would have logged onto it, checked to make sure the default router password was the default (I'm sure it was), secured the network (so that only I had access) and changed the password on the router. But, then I wouldn't have any use for my own wi-fi router, now would I...? Anyways...

Re:Security?

[BrokenStructure]

Everyone keeps saying WEP is so breakable... So, having just installed a wi-fi network at home, do you have any suggestions on what I should use? I already don't broadcast my signal, and I've been using WEP. My router has Radius security as an alternative to WEP (along with a couple others, including some sort of Radius blend). I'd appreciate any input =)

Re:Security?

[Trejkaz]

Since we're talking about wireless, and the fact that a random sniffer can't determine where the packets are going, how does a legitimate computer on the network determine where the packets are going?

Does my handheld have to decrypt everything it receives, whether or not it's destined for the handheld, in order to see which address it is to, and then discard it?

Re:Security?

[Jahf]

I use WEP at home and I'm fine with it since you have to be in my yard to get a decent signal (or target me with a serious antenna from a distance, and I don't broadcast SSID like at least 20 other people in my town -do-, I'm not so worried about that).

If I were less lazy, I would turn WEP off and setup a VPN subnet. Only IPs from the VPN subnet would pass from the wireless gateway to the rest of your network and vice versa. Then simply use the VPN from any PC connected to your wireless.

A bit more of a pain, but quite secure. I don't bother since 99% of my network traffic goes to the Internet and my 'net connection is unencrypted 802.11b to my ISP, so even if I locked down my local signal everything but local traffic is still be beamed 2 miles away. Luckily it's a tight beam and pointed over the tops of all the trees and houses, so it is fairly hard to intercept but not impossible.

Note that RADIUS is a way of replacing WEP authentication (shared key) but not a way to replace WEP encryption.

Re:Security?

[Trejkaz]

Well, the algorithm for the door is fairly well known, and an adequately skilled locksmith (or thief) knows the algorithm and knows how to iterate over the various keys, so you could argue that it's not really security by obscurity, but rather a well-known algorithm which is easily brute-forced. :-/

Re:Security?

[kaoshin]

I agree, and feel free to also mod me a Troll. The safe in my house has a pretty good lock. The trick is it would take someone very clever to even find it to begin with. Some people ripped me off, but guess what? They never even made an attempt at cracking my safe in the first place because I outsmarted the bad guys. Hiding the safe is security through obscurity, hiding the safe without putting a lock on it is retarded and apparrently what everyone knee jerks to when they hear obscurity. Get over it, people have been using security through obscurity long before any of us were born. Ever hear of a buried treasure?

Re:Security?

[BrokenStructure]

Thanks for that.

I suppose I'll stick with the WEP for now, too. The only thing I'm really worried about is people getting access to my router. But to fix that, I don't broadcast. When I first set up my wireless my neighboor was broadcasting. It would have been so easy to hi-jack his connection, kick him off his own network and change the password on his hub... but then I wouldn't have a reason to use any of the equipment I just paid for ;).

Re:Security?

[wwphx]

Enable MAC filtering, it should be accessible through the web interface. Make sure you're using 128 bit keys. And change your SSID away from the factory default.

Yes, you can break WEP, but it isn't like throwing a baseball through a window. You have to capture a lot of packets (as in thousands, if not a million) and then subject them to analysis to get the initialization vector as the IV is the weakness in WEP.

Check out netstumbler.org and read up on how to war drive and break WEP. I'm suggesting it from purely an academic standpoint, it's interesting stuff and valuable information.

Re:Security?

[Anonymous Coward]

to much

"too".

Re:Security?

[Bishop]

Does my handheld have to decrypt everything it receives

In theory yes. It is not nearly as hard as it sounds. The device only has to decrypt enough to get the destination hardware address. A hardware crypto coprocessor does all the work. In practice 802.11 only encrypts the frame body. The source and destination hardware addresses and some other control fields are sent in the clear.

Re:Security?

[g0bshiTe]

A typical door tumbler has between 5 and 6 "cuts", with each one of those cuts having some 30 different sized tumblers. One key could potentially open more than just the lock it was intended, but why go through the hassle, most door frames cant stand up to a swift kick anyway.

Re:Security?

[cgaylord]

Please stop abuseing the phrase "security through obscurity." The catch phrase was meant to apply to one and only one case: The practive of obscuring encryption algorithms. Bruce Schneier's thesis was that an encryption system that relied on a secret or hidden algorithm was not secure.

You are incorrect. "Security through obscurity" long pre-dates Schneier. It originally referred to systems, e.g. mainframes, that were so cumbersome to use that their use was considered obscure. It had nothing to do with encryption; it applied to situations where there was no encryption, and you just had to know where and how to look to get access to data. It is still used, for example, by having data on a publicly available web server but not having the data in any browsable index. Obviously this is not a very strong method of securing data, but in certain contexts it may be entirely suitable. In some sense, any common shared secret system could be viewed as "security through obscurity" (e.g. WEP), but usually we mean something weaker still. Schneier simply applied this principal to the case of encryption algorithms.

Re:Security?

[beegle]

I love slashdot. After I made this post, I was worried that someone'd call me out on my use of the phrase "traffic analysis". Most people use "traffic analysis" to refer to a sort of meta-analysis: that is, looking at where messages are going and their characteristics rather than the contents of the messages. I was thinking of the routine "scan the traffic looking for known plaintext".

Instead, I got an angry follow-up that was just plain wrong, missed the point, and pulled the "I think you might be wrong, but I won't do any research" trick. For what it's worth, info on the Kerberos changes is available from ftp://athena-dist.mit.edu/pub/kerberos/doc/krb_evo l.PS
This is a summary, but there's mention on pages 5 and 7 of the encryption changes and the movement of some data to plaintext.

Re:Security?

[_Sharp'r_]

I'm saying that in the specific case we are talking about (Wireless networks), lack of obscurity at the lower network levels can contribute quite a bit to allowing real-world vulnerability.

That's not to say that you shouldn't lock things down, but it does also help to hide them too. The lower network level stuff is very useful to an attacker and thus should be hidden from them if possible.

We'll finally be secure when 802.11z comes out ...

[xmas2003]

Because then there will be no more letters. P.S. Yes, I DID read the article before posting and it kinda implied this point too!

Security?

[Quasar1999]

Why is it that applying security at a higher layer is a bad thing? The data is what needs to be secured, not the headers of the packets... I don't care if people know I'm sending data to my credit card company, I do care if they know what my login and password is though... Am I missing something? Why is it so important to apply security to the lowest layer?

AES, buzzword of the moment

[Anonymous Coward]

AES!=SECURE! It's how you implement it and use it that makes you secure!

AES is the buzzword of the moment. The real question: is 802.11i implemented in such a way that it is secure from the get-go (even at the expense of usability), and implemented in such a way that it can be upgraded quickly and easily should exploits be found.

Well?? I don't give a damn what algorithm it uses, I just want it to use the algorithm CORRECTLY.

Re:AES, buzzword of the moment

[Anonymous Coward]

I prefer to dobule encrypt ROT13 for higher security.

This Message is Encrypted with Double ROT-13 cryptography. Attempting to circumvent this encoding is illegal under the Digital Millennium Copyright Act.

Re:AES, buzzword of the moment

[p2sam]

How is this insightful? It offers no insight. Most people already know this.

Maybe if the OP offers a critique of how AES was implemented in 802.11i, then it's insightful...

Re:AES, buzzword of the moment

[SCHecklerX]

Agreed. How are keys exchanged/updated? One of the biggest problems with WEP is that it is impossible to manage keys. So, they never change.

Re:AES, buzzword of the moment

[Anonymous Coward]

How about ROT13? Can we use that?

Sure, if Mozilla's newsreader supported it.

(Still can't believe that Moz 1.7 doesn't have a ROT13 button in their newsreader.)

You insensitive clod!

[Sediyama]

I use a not allowed shared 802.11 connection!

AES really secure?

[Anonymous Coward]

"AES, a strong encryption standard that passes muster with even the most paranoid security administrators."

If it's really secure, why does our favourite tree-letter-agency allow it for normal citizens? So much for paranoia...

Re:AES really secure?

[Anonymous Coward]

A tree letter agenct huh? E-MAIL ME FOR A GMAIL INVITE! I HAVE 3 LEFT!! clowncommando@hotmail.com!! Hurry!

Re:AES really secure?

[finkployd]

Perhaps because it was not invented in the US?

Perhaps because the NSA already tried (and failed miserably) to obtain and enforce a monopoly on cryptography. (remember clipper? well phase II was to make all non clipper cryptography illegal, they failed)

There are legit explanations besides the old "NSA can break ANYTHING" one.
Frankly it is probably easier for them to intimidate/bribe people into giving them encryption keys than breaking the algorithm.

Finkployd

Re:AES really secure?

[Anonymous Coward]

in a paper i wrote about encryption and the methods to break it, i included the "digit method"

how many digits (fingers) do i have to cut off before the person gives up the key.

considering the average user is willing to give their password up for a candy bar, my estimate, not many.

Re:AES really secure?

[Anonymous Coward]

hope you have a prosthetic finger available for me, b/c the only way i remember my password is by the feel of typing it in.

Re:AES really secure?

[Paul Crowley]

"rubber hose cryptanalysis"

Comment removed

[account_deleted]

Comment removed based on user account deletion

ARGH!

[nuintari]

You can't throw pretty sounding state of the art encryption schemes at something and call it secure. WEP's failing was not a bad algorithem, RC4 isn't new by any means, but its nothing to turn your nose to. When used properly, it can do the job. But WEP used predictable session id's, a tiny key space, and a whole host of recomended but "optional" wep concepts that the manufacturers ignored because they were all harder to implement.

Wep was designed with the model:

1. pretty acronyms.
2. mumnle mumble mumble
3. SECURITY!!!

You could use AES in wep and it would still be breakable, the key exchange was piss poor, making the entire system piss poor.

I didn't read the article, this was just me bitching at the slashdot post, and people who believe fancy new encryption = security automagically.

Re:ARGH!

[Martin Blank]

This is where 802.11i is a bit different, though, in that the new security features are mandatory. Missing small points, no matter how difficult, will fail the certification.

Re:ARGH!

[nuintari]

Its a start, but I still wager a good chunch of change that they fuck it up.

STill doesn't change the fact that you can't throw AES at something and get the happy land of magical computer/network security.

Re:ARGH!

[nuintari]

Sir, I am in your debt, you say projectile bludgeoning results in security, I must learn more!

Re:ARGH!

[karnal]

You will be in someone's debt if you go around smashing your hard drives, that's for sure!

Re:ARGH!

[IWannaBeAnAC]

WEP was designed to be insecure. The whole process (and even the acronym!) was dictated by nervous governments who fear subversives and don't give a s**t about criminals making life hell for their citizens.

802.11i appears to be a genuine attempt to create an open and secure system that is (mostly) free from the interference that crippled WEP.

Re:ARGH!

[Anonymous Coward]

flamebait indeed.. the fact that garbage like this is rated +5 is exactly the reason nobody takes this board seriously in any remotely technical context

Re:ARGH!

[Paul Crowley]

The attack on WEP depends critically on weak key scheduling in RC4. Substitute an algorithm with a sufficiently strong key schedule, such as AES, and you won't see the same problem.

I agree that "AES" isn't a magic incantation to make things secure, but TBH it's a happy day when we're having to explain that, instead of having to explain why hand-rolling your algorithms isn't such a good plan. With WinZip, it even seems we're having to explain why using a secure encrypt-then-authenticate mode with secure primitives doesn't automatically mean freedom from all attacks - an amazing bit of progress.

Re:ARGH!

[swillden]

WEP's failing was exactly a bad algorithm.. the fact is that the first 200 bytes or so of any RC4 cipher stream are predictable

No, WEP's failing was the misuse of a good algorithm. RC4 is a solid, well-respected algorithm, but using it correctly requires that the first few hundred bytes of the the keystream be discarded after every rekeying operation.

Its about time!!

[supersam]

All through the time I spent developing WLAN software, security was always the bottleneck. We always had to keep one thing at the back of our minds - if security isn't improved, all this work is gonna get flushed down the drain!

Fears about security have prevented WLAN from achieving all that it can potentially achieve. It was ridiculously easy for someone to break into a wireless LAN. 802.11i was seen to be the saviour, but the infighting among the various stakeholders always prevented the mechanisms defined under 802.11i from being accepted globally.

I hope things will change for the better now!

Re:muster?

[jeepmeister]

Yellow substance good on hot dogs ... no, wait.

To Little to Late

[batboy78]

Is this new 802.11 product going to do well? With new technologies on the horizon such as WiMax will companies and businesses invest anymore money to upgrade or rollout an 802.11 product?

Re:To Little to Late

[Wesley Felter]

A lot of people can get 802.11i with free firmware updates.

Also, WiMax doesn't really compete with 802.11.

Re:muster?

[meringuoid]

The real question here is what exactly is muster?

Naval expression, I believe. All the sailors gather (or muster) on deck and the captain inspects 'em. If their kit is all in order, they've passed muster.

Getting There...

[diagnosis]

Here is the problem: Most people *still* aren't going to turn on encryption, and 802.11i doesn't address one of the biggest regions people don't turn on encryption:

Encryption makes configuring your wireless network 10x harder for the average person.

As the article recognizes, "the lack of a single, universally accepted standard will inevitably lead to implementation and interoperability challenges."

Encrypted wlan communication needs to be so straightforward that end users can connect to *any* access point and be assured of privacy without any additional configuration.

So what is the average user supposed to do? Just keep waiting, I guess...

Re:Getting There...

[diagnosis]

>Here is the problem: Most people *still* aren't going to turn on encryption, and 802.11i doesn't address one of the biggest regions people don't turn on encryption:

regions ==> reasons

Re:Getting There...

[LoudMusic]

Encryption makes configuring your wireless network 10x harder for the average person.

And most people aren't up to average - the geeks throw the ratio all out of wack.

In order to sell products the wifi manufacturers make it as easy as possible, but they DO include security options. I'm not going to argue about that.

A) Free wireless access for me and my friends through people who don't care enough to secure their networks.
B) Keeps me employeed securing networks of those who are interested.

Re:Getting There...

[tbmaddux]

Encryption makes configuring your wireless network 10x harder for the average person... So what is the average user supposed to do? Just keep waiting, I guess...

Nah. The average user will continue to deploy unsecured WAPs with default admin passwords, and it won't be that big of a deal. The average user just does not care. He's about as worried about this as he is about someone coming over and using the BBQ grill on his porch.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:muster?

[Exatron]

It's that yellow, sometimes yellowish, goop people put on hot dogs, duh.

Re:muster?

[Quirk]

It's "pass muster"...muster is a roll call of troops or an inventory. To pass muster is to have enough x on hand for the job.

5 million packets and 1 minute...

[tcopeland]

...to crack WEP, according to Airsnort. Whew!

Re:We'll finally be secure when 802.11z comes out

[dago]

yeah, hopefully, they also go to 2 letters standards, otherwise we wouldn't have got Gigabit ethernet over copper (aka 802.3ab)

Interesting Traffic...

[csmacd]

If I'm looking at your traffic, and your headers are not encrypted, then I can determine which packets may be interesting (the ones to credit card company, commercial sites, etc) and which packets aren't interesting (web surfing, MUDing, email). Makes the job of the hacker much easier, only needing to break the encryption on packets that have a much higher probability of containing good information

Re:muster?

[cbovasso]

muster is something you double-time to so the skuttlebutt about your chit being revoked isnt true and you wont be forced to go AWOL. d'uh.

wait a minute

[rozz]

To address this issue, Cisco and Microsoft contributed a rather crude pre-authentication algorithm

... sniff... sniff... do i smell somethin rotten here?

could it be that the default keys are all 1 bit ? ... for users convenience of course.

Re:wait a minute

[Anonymous Coward]

no the keys would be 2bit, it fits with their corporate philosphy/image

Reverse Spelling Errors

[Bishop923]

from the segessem-terces-ylotot dept.
Reversal:
totoly-secret-messeges

Re:Reverse Spelling Errors

[mdielmann]

On the plus side, Taco is consistent....

Re:Reverse Spelling Errors

[6Yankee]

That's not bad spelling... that's Level 2 encryption! If you want to get really fancy, you can ROT-13 the whole mess...

Re:Reverse Spelling Errors

[NeoSkandranon]

you can ROT-13 the whole mess...

Twice, for extra security ;)

Re:Reverse Spelling Errors

[Trejkaz]

DROT-13 is the best algorithm ever because it contains advanced technology which permits the human brain to instantly understand it, without buying any additional software!

And therein lies the problem

[Effugas]

Encrypted wlan communication needs to be so straightforward that end users can connect to *any* access point and be assured of privacy without any additional configuration.

No.

Because then you don't necessarily know if you're connecting to an attacker's access point or not. This is mostly why security doesn't belong at L2 -- you don't care or trust the next hop, you trust the endpoint (or at least some faraway gateway that gets you into the endpoint).

--Dan

Re:And therein lies the problem

[diagnosis]

That is a fair point, but adding security at L2 at least limits the number of listeners to your conversation.

Realistically, users are going to connect to whatever AP they can reach. I don't see how you deal with attacker APs other than by encrypting at higher levels, or adding L2 authentication/certs. The latter seems pretty undesirable.

11i is the solution to not quite the right problem.

Re:And therein lies the problem

[Effugas]

Limits passive listeners, not active.

There are some very, very ugly active attacks that people haven't even begun to explore.

That being said -- 11i solves the problem of, given a widely distributed network of corporate access points, how do you prevent people from rummaging around your internal network without going to a concentrator? Answer -- force them to check in w/ 11i.

--Dan

Comment removed

[account_deleted]

Comment removed based on user account deletion

AES is good enough for the most paranoid?

[oostevo]

"802.11i's privacy services are built on top of AES, a strong encryption standard that passes muster with even the most paranoid security administrators" No, not really. I would much rather use Serpent (the AES runner-up) than Rinjdael (the AES standard) for my encryption. As one of "the most paranoid security administrators," I'm rather annoyed that speed was chosen over security for the AES standard.

Re:AES is good enough for the most paranoid?

[digitaltraveller]

Correct. As I pointed out in this vitriolic posting last year, the security of AES is possibly weak. (See the citation).
As a relatively new cipher, this is not unexpected. The conservative security choice would have been to choose 3DES, as the new DES.

Although it's pure speculation, it's possible Rinjdael was chosen by interested parties and deemed 'strong enough for commerce' for reasons related to catching filthy cave dwelling scum.

Reality is that which continues to exist after you stop believing in it.

Re:AES is good enough for the most paranoid?

[LanMan04]

Why is Serpent better than Rinjadel? Hardware AES is fast enough to encrypt streaming HDTV (I think), and if you had a machine that could crack DES (yes, single DES) in like 1 minute it would take something like 100 trillion years to crack AES with that same machine.

Re:AES is good enough for the most paranoid?

[oostevo]

Well, there's this method for cracking AES called eXtended Sparse Linearization that came around in 2002 or so (the attack is a method for solving systems of quadratic equations). Problem is, we don't know if the attack works, but if it does work, it'll only get better. If the optimizations for the attack (assuming it works ...) get down to 2^70 or 2^80 or so complexity, AES will be obsolete by the end of the decade. And that's why I don't think AES should be widely implemented just yet.

Corporations

[mrnick]

As a person working in the network security arena for nearly 15 years the problem is divulging your internal topology. Now this might not bother you at home for corporations that deal with real data (see $$$) are very concerned about this.

I have worked with the air fortress and it encrypts at the layer 2 level so no network topology can be determined.

Very nice but it would be even better is it didn't require a client or that the client was ubiquitous with the driver.

Nick Powers

Dangerous consequences

[Anonymous Coward]

Mark my words. This will suck. In the future, instead of driving by in the VW van, stinking hippies will be induced by this new security to break and enter your home so they can steal your SSID and keys from your browser. This will get ugly real fast. I'm sticking with linksys/admin for the safety of the children.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:muster?

[johnnyb]

Nah, man, it's almost lunchtime. He was asking someone to pass the mustard.

Why use WLAN encryption at all? Use IPsec!

[gst]

We already have other and better options. Just disable WEP and use IPsec on your accesspoint.

Yeah - it's a little bit slower when the en/de/cryption is done on the client but in most cases you won't notice. And on the AP you can use a crypto accelerator.

If you don't want to use a PC as AP just use http://www.m0n0.ch/wall/ in combination with http://www.soekris.com/net4501.htm (they ship with cases too :) - that should do the trick.

Re:Why use WLAN encryption at all? Use IPsec!

[Cred]

That's a good point. So far these security features have been good for.. well, for some time but after a while they are found to be exploitable oslt. I like the idea of one making HW and one making SW. Using GNU/Linux or *BSD systems on the software side should be enough. I understand that it's not a big selling factor saying that our product needs additional OS and SW to run but hey, atleast it would be the admin who decides how the data is encrypted. Of course, it's much about the client side also but atleast we would have the chance.

Taking the load off the programmer

[lachlan76]

To be realistic, if you (as a programmer) are sending data that you know at the design stage that you want to keep private, you should be ancrypting it at the APPLICATION layer. If you are going to send data that you want transmitted securely, you shouldn't depend on the lower levels to do something which may or not be present. However, if you are using it as a way to keep unautorised user out of the network, you could do something similar by signing the packets as they are sent. This would cost you speed though, and it is easier to just encrypt with whatever cipher is in style at the time and check if the packet is valid.

Re:Taking the load off the programmer

[Ignignot]

you could do something similar by signing the packets as they are sent...it is easier to just encrypt with whatever cipher is in style at the time and check if the packet is valid.

I fail to see the difference between your two suggestions. Just tacking some sort of signature onto a packet (like a session id or something) would not work because it would be in the clear. There is no choice but encryption.

Re:Taking the load off the programmer

[lachlan76]

What I meant was just signing an MD5/SHA-1/etc checksum using a public key algorithm, like PGP/GPG does.

Using a public key cryptosystem would help by authenticating users with the access point. And then perhaps encrypting it too, with a randomly generated session key pair, one from the AP, and one from the client, so that it is encrypted and signed to keep data private, and verify the sender. The drawback is that it is slower than using a symmetric algorithm (They can be smaller: When I look at RC*, I think "Hey! I could do that in assembly!". When I see almost anything else, my reaction is: "Fuck it." I'm not doing this as a job, so I can be lazy) but I'd imagine processing power is not an important factor in 802.11 bandwidth.

Layers

[ccoder]

There have been a few interesting ideas if not brilliant, but not properly executed. I'm no encryption guru, but simple username and password based security isn't all that bad, as long as the medium they're transmitted over is secure. The problem, though is how to "make" them secure.

At some point you have to start trusting the network, and stop worrying about how big your key is, or how long it takes to crack. Use a VPN for work. Use SSL for private email. Don't auto login to websites. If people start assuming they're secure because their first hop is, they're screwed, no matter how thick that first layer is to crack.

Re:We'll finally be secure when 802.11z comes out

[Anonymous Coward]

No, they only have 2 dot-separated groups of at most 3 alpha-numeric characters each... so 2 digits and 1 letter, or 1 digit and 2 letters, but never 2 digits _and_ 2 letters :P

Security out of the box

[chia_monkey]

The main problem here isn't HOW secure you can make something, but IF you secure it or not. There are already many options available to make an 802.11b network nice and secure. Just do your homework and you can get it done.

The problem is, all these devices are shipped for easy setup. Easy setup means "security off". People set up their networks and quit there. No wonder everyone thinks WiFi is insecure. It's a network, just like a wired network. Go through the steps to secure the wireless network too fellas. If we can get people to turn on the security features right away, or do as Apple does and ship stuff with all ports closed and security functions on, then we'll be in a better place. Sure, it may make setting up your WiFi network a bit more cumbersome or time-consuming in the beginning, but that extra five minutes is well worth it.

Re:Security out of the box

[supmylO]

You're completely right. I just got my laptop yesterday (first experience with wireless) and right when my computer booted up it told me there was a wireless network I could connect to. Now, I knew this was unlikely since I turned my routers access point off, but sure enough someone who lives near me has an open wireless network. I took (minimal) security measures when I put my wireless network up , but it's still a lot more than these people... Free internet!

Re:Security out of the box

[williamhooper]

Sure, just default it to on so everyone will be secure... using the default keys.

Test how many open WAP have the default password for their web administration and you will see my point.

It's all about key management

[Anonymous Coward]

AES doesn't help you if the attacker snarfs your key...they throw around some fancy names for authentication protocols but don't actually say how keys are distributed. Anyone?

Personally, I don't see why they don't use public-key systems for this stuff. Why doesn't each client just generate a keypair and use that to exchange a random session key?

Re:It's all about key management

[Anonymous Coward]

Key management isn't sexy enough to get copy in the techno-bling magazines or warrant hot shiny booths at lame IT conferences.

Some shops do KM right, but until more of them do, you are correct to roll your eyes at some of the acronym-laden copy that the PR houses keep spewing and doubt the real security their products provide in the context of these less-adept organizations.

Re:It's all about key management

[Trejkaz]

I say fuck it. I will just GPG and TLS encrypt all the critical data which goes over the wire anyway, just like I do now... Sure, they can add another layer if they want, but only if it's not going to lag my wireless link.

Please learn about crypto before trying to teach.

[Paul Crowley]

Crypto 101: don't encrypt any redundant or easy-to-guess data.

Completely wrong. Crypto 101: don't try and work around unknown flaws in the crypto at higher protocol levels - you're doomed to be chasing your tail forever. Use a secure protocol, and rely on it. AES in EAX mode will be secure no matter how redundant or easy-to-guess your data is.

I'm pretty sure your information about Kerberos is wrong - the Kerberos people had better cryptographers than to make a mistake like that. There were other cryptographic mistakes, though - in particular they tried to encrypt and authenticate with a single pass of the block cipher, a problem that wasn't correctly solved until IACBC and IAPM were proposed by Jutla in late 2000.

Re:I wonder...

[theendlessnow]

...But WEP used predictable session id's, a tiny key space, and a whole host of recomended but "optional" wep concepts...

The weak key problem has been addressed by all manufacturers via firmware updates. You are now forced to do dictionary attacks which require a large number of packets and resources. Still hackable, but not nearly as easy.

I didn't read the article, this was just me bitching at the slashdot post, and people who believe fancy new encryption = security automagically.

You need to read the article (which I didn't read). I don't need to read it since I know about the changes already. You'll find the key exchanges when combined with a true AAA provide a secure solution.

With that said, we're talking about transmissions that are easily monitored and disrupted at will. So while 802.11i is a step forward for wireless, just being wireless means that it will always be less "secure". I certainly wouldn't want wireless as a part of a critical availibility network.

Yes, AES really is secure

[Paul Crowley]

The AES process was designed with the help of the worldwide cryptographic community for maximum openness and public participation. The winning algorithm was designed by two Belgians; it's way too simple to hide any chicanery in. It has now seen more cryptanalysis than any other algorithm ever except DES - which, incidentally, IBM/the NSA secretly wired to make *more* secure - and held up well. There's not a reputable cryptographer anywhere in the world who thinks there's a serious chance of AES being broken in a way that would do an attacker any real good.

The NSA approved all five finalists for the AES algorithm. If you really believe they can really break all five, then you might as well give up and start forwarding the plaintext of your email to nsa.gov now.

There's just no sane way to maintain the belief that the NSA somehow rigged the whole thing so they could read your messages. Don't let me deny you your tinfoil hat though.

Re:Yes, AES really is secure

[bugnuts]

AES does not pass muster with the most paranoid. Not yet.

There are attacks that have not been tested, and are undergoing some rigorous mathematical attacks now. I personally do not know the details, but it involves establishing a 1:1 mapping onto a finite field or reducing it to an algebraic cipher. One of my crypto friends is working on this right now.

AES was accepted by NIST before it was fully tested. I do not trust it, and I'm not even the most paranoid.

More info here.

Re:Yes, AES really is secure

[Anonymous Coward]

Linkies! Linkies! Linkies! (Please?)

Or post your links to The Cryptography Mailing List

Subscribe by sending "subscribe cryptography" to majordomo@metzdowd.com

Re:Yes, AES really is secure

[Paul Crowley]

I read the page you referenced. I have never seen such partisan writing from a professional cryptographer! In particular it's a bit off the way he cites Murphy and Robshaw as if to say that they believe the XSL attack is practical, where in fact they go to great lengths to state that they do not believe there is sufficient evidence to claim a break in AES.

I don't think NIST left enough time for the AES process - especially since they asked for something so novel (there were very few 128-bit block ciphers when they put out the call, and there's a lot of ways in which their cryptanalysis is different - integral cryptanalysis being the obvious example). And I confess, I wish that Rijndael had been specified with a Twofish-like S-box (as do, I believe, the designers). But nonetheless, I think we've ended up with a very fine cipher in which we can all have great confidence.

AES is good enough for the most paranoid.

[Paul Crowley]

Last I heard, it look like the Courtois and Pierpzyk attack wouldn't fly. And wasn't that attack *more* effective against Serpent than against Rijndael anyway?

Even the designers of Serpent would say that they believe there are no practical attacks against AES. I voted for Serpent myself, but I still believe Rijndael is an excellent cipher the whole community can rally behind, and overwhelmingly that's what the crypto community is doing.

Re:AES is good enough for the most paranoid.

[digitaltraveller]

According to Don Coppersmith, the technique has merit. Considering the source, that's a strong statement.

Yes, the attack is applicable to ciphers other than AES.

No it's not a practical attack. A practical attack and an academic break are completely different things.

For example, a theoretical attack that reduced key recovery time from 10^14 MIPS years to 10^6 MY is still probably impractical to break for most attackers. However, the loss of security in such a scenario would be considered serious.

Re:AES is good enough for the most paranoid.

[Paul Crowley]

The only writing from Coppersmith on the XSL attack I can find argues against its practicality, can you give me a cite?

We do not know whether the attack is applicable against any ciphers. However, if it will fly, then Serpent falls harder than Rijndael does - a surprising result for everyone, and evidence against the lobby that says "NIST should have gone for Serpent for security, not Rijndael for speed".

I confess at this point that, like Schneier, I'm not 100% certain that no academic attack on Rijndael will be found, but I an 100% confident that no attack that does anyone any good will be found. Indeed, Anderson in his summing up argued not that there was any danger of a practical break in Rijndael but that the risk of an academic attack damaging public confidence was too great.

Remember John Kelsey's observation: in practice, if all the block ciphers in the world were replaced with the famously insecure FEAL-8, on which half the world's cryptographers seem to have cut their teeth, it would probably make almost zero practical difference to the security of the world's cryptosystems because some other part of the system is nearly always easier to attack.

Perspective

[chill]

I'll take the unpopular opinion here... WEP is a good thing and serves a vital function. By activating WEP, even with all the flaws, you are essentially "locking the door". Yes, it is a paper door with a crappy lock, but that isn't the point. The lock is there to tell you you're not supposed to be in as much as it is to keep you out.

The point is by securing the network at all you are putting up the equivalent of a "private property" sign. Legally, it helps a great deal. I can see a defense argument for an unsecured AP that is shouting it's SSID into a 2 block radius. However, if you have to crack it, then there is no question about legality -- you are breaking the law.

No, don't rely on WEP for security. Use and IPSec tunnel on top of it if you want security. But WEP *does* serve a great purpose in wifi -- covering your ass legally.

-Charles

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:I wonder...

[nuintari]

The weak key problem has been addressed by all manufacturers via firmware updates. You are now forced to do dictionary attacks which require a large number of packets and resources. Still hackable, but not nearly as easy.

I know.

You need to read the article (which I didn't read). I don't need to read it since I know about the changes already. You'll find the key exchanges when combined with a true AAA provide a secure solution.

I was pointing out that magic acronyms do not equate with great security, in response to the /. post. I'm sure 802.11i has some improvements, which time will test, but my original post had little to nothing to do with wireless other than as an excuse for me to rant off on how much I hate those magic acronym weilder, such as the one in the /. post.

And I have hence read the article, but I would post to another thread to post about its merits/failings. as I said, my original post was about the broad world crypto, and how most of the world just doesn't get it.

The real problem is consumer/soho grade Wi-Fi.

[Anonymous Coward]

Both lack of awareness from users and lack of sane security defaults on wi-fi hardware. Only a true tech head or systems admin would be bothered about security.

My wi-fi AP has a unique serial number and mac address stuck on a label on the box. Would it really be too differcult for a manufaturer to make a default admin password and shared key using random codes and then print these in the manual or on a sticker on the AP?

Re:The real problem is consumer/soho grade Wi-Fi.

[Anonymous Coward]

Not at all... but it would cost money for something that most likely won't affect the user's purchase decision. If anything, it would be a deturrent because people would get the AP, then actually have to follow instructions to set the thing up, instead of just plugging it in and starting their other wireless devices

Re:We'll finally be secure when 802.11z comes out

[Anonymous Coward]

I want 802.11L to come out, how else are we going to get ludicris speed out of our networks

Re:wireless has always been hard to secure

[Mr Guy]

Again?

Re:We'll finally be secure when 802.11z comes out

[Throtex]

Personally, I'm waiting for wireless ethernet over copper wire.

Security through obscurity is just another layer

[Anonymous Coward]

of security, in some cases (not all).

Think about the secret NSA cipher designs. You can't see those. What if they're weak, and you could tell by just looking at the designs in a thorough manner? Now you can't since they're secret. Security through obscurity adds another layer of security in that case.

Bah! It's fluff!

[Anonymous Coward]

Maybe I have my terms mixed up, but the article doesn't seem to be much of a review. I'll summarize the article:

- 802.11i has a new authentication scheme
- 802.11i uses AES for encryption instead of RC4

What I basically gleened from the article is that that 802.11i uses some of the most advanced buzzwords in the industry. I'm not saying that I think 802.11i is fluff, but the article linked above has 8 paragraphs that could have been boiled down to 1 or 2 with the same amount of factual information.

I'll rewrite the article here:

802.11i is secure! It uses AES and a new authentication scheme! It's secure now! All those nasty wireless hackers and wardrivers are finally locked out of your network! Security is here and you can buy it from Microsoft, Cisco, Atheros, and Broadcomm.
(end)

The article really just strikes me as hype. Perhaps justified hype, but so far the leading edge of 802.11i seems to be marketing rather than facts. $DIETY forbid this hype actually catch on and people start thinking about security on their APs, but somehow I just don't see it happening.

My opinion and skepticism are of course worth the paper they're printed on here.

AES is not good.

[Anonymous Coward]

"AES, a strong encryption standard that passes muster with even the most paranoid security administrators."

Actually not. There are ~3 parties in the world that have possibly the capability of cracking that. If they think it's worth it that is.

The Americans like the big brother thinking where the government is looking out for them.. Some other people like russians do not trust even their own. I would trust their stuff any day over the AES.

Not that it is bad.. It's something no amateur can break, considering the implementation is done flawlessly. For instance Winzip boasted for a while "AES Encryption".. Well, they got plain owned.

Faster is Better

[bill_mcgonigle]

I'm glad they chose Rinjdael for speed.

It means cheaper faster ASICS which means more encryption happening.

If Serpent costs more to implement less AES will be happening.

As AES approaches "free" encryption gets thrown in everywhere, leading to a more secure national infrastructure. If Rinjdael over Serpent accelerates this process by a year or two, that might be very significant. Of course, it could also be meaningless, but we just don't know.

Re:Faster is Better

[Anonymous Coward]

As AES approaches "free" encryption gets thrown in everywhere, leading to a more secure national infrastructure.

Right... well, we can all hope.

To paraphrase conventional wisdom (and probably Bruce Schneier):

Encryption algorithms are the easy part, the hard parts are avoiding implementation bugs and having a secure method of key exchange.

(WEP's problem was one of key management. Too difficult to change keys once you pass a few dozen devices and multiple access points. Plus, there were weaknesses in the implementation.)

Personally, I'd love to see everyone using encryption for everything, including e-mail messages. But I'm also betting large that the majority of implementations will have major security flaws and that most attacks will be as simple as breaking the key management side.

link

[MasTRE]

Hey, "Uberhacker.Com" - next time you post a link, remove the session id from it!

NSA doesn't just allow it, they use it themselves.

[caveat]

"The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths." [PDF]

Of course, in this context, "NSA-approved cryptography consists of an approved algorithm; an implementation that has been approved for the protection of classified information in a particular environment; and a supporting key management infrastructure." I suspect 99.99% of civilian users of any encryption lack an NSA-approved key management system...

Re:NSA doesn't just allow it, they use it themselv

[Anonymous Coward]

Don't be silly. NSA uses their own type-one algos for the serious classified stuff. They do not use AES, at any key length. Also keep in mind it isn't just NSA's job to "use" crypto, they specify its use elsewhere, so expect to see that pattern repeated i.e. DoD etc. as well. Cheers.

Re:ARGH! (RC4)

[WuphonsReach]

RC4 is a solid, well-respected algorithm, but using it correctly requires that the first few hundred bytes of the the keystream be discarded after every rekeying operation.

Out of curiosity, why?

(Got any links so I can read up on the why and wherefore?)

Woefully inadequate? Nah, just poorly implemented.

[Xabraxas]

the security features found in the original standard were woefully inadequate

I wouldn't necessarily say that WEP is woefully inadequate as much as it is extremely poorly implemented. It could have worked well but it had serious implementation issues.

As all slashdotters probably already know about:

The (in)security of WEP

Re:ARGH! (RC4)

[swillden]

Out of curiosity, why?

I don't recall the details, but an attack was found a few years ago that allows the key to be recovered if the attacker can get the first few bytes of the keystream. Doing it requires the first few bytes of many related keystreams, and getting the keystream from the ciphertext requires that the attacker have the plaintext. With WEP, RC4 is rekeyed for every packet, and the first few bytes of each packet are highly predictable, so an eavesdropper can fairly easily gather enough data to mount the attack.

Got any links so I can read up on the why and wherefore?

Google turns up plenty. Here is the original paper, which has all of the dirty details. Here is a paper that describes how to use it to attack WEP. And, of course, if you'd like to read code that implements the attack, look at Airsnort.

McGonigle..

[Anonymous Coward]

What ever gave you the idea that you're allowed to post again?

Re:NSA doesn't just allow it, they use it themselv

[caveat]

oh, i'm not claiming AES is the NSA's super-duper-tippity-top-secret encryption, just pointing out that they allow for its use, which has gotta say SOMETHING about Rijndael. whether that something is the robustness of the algorithm or the ease of backdooring is left as an exercise.

Re:NSA doesn't just allow it, they use it themselv

[Anonymous Coward]

I'm guessing that the reason they don't trust 128-bit keys for TOP SECRET is they don't know how soon they will be facing serious quantum computers -- as well as walking through all known public key encryption algorithms (ones based on prime factorization, discrete logarithms, or eliptical curves) as if they were made of tissue paper, quantum computers could crack any private key system by brute-force exhaustive search as fast as a comparable conventional computer could crack one with keys of half the length. I.e. to a quantum computer, 128, 192, and 256-bit keys would be as secure as 64-bit, 96-bit, and 128-bit keys are now. The NSA needs to worry not just about what can be cracked now, but what might be crackable in a decade or two. In that light, their recommendations make a lot of sense.