Slashdot Mirror
Security evaluation of 802.11i
Uberhacker.Com writes "Server Pipeline features an interesting report on the security viability of 802.11i. As most observers of the WLAN industry are aware, the security features found in the original standard were woefully inadequate. To a certain degree, these deficiencies reflected the perception that security services are normally implemented at layer 3 and above. 802.11i's privacy services are built on top of AES, a strong encryption standard that passes muster with even the most paranoid security administrators."
Why is it that applying security at a higher layer is a bad thing? The data is what needs to be secured, not the headers of the packets... I don't care if people know I'm sending data to my credit card company, I do care if they know what my login and password is though... Am I missing something? Why is it so important to apply security to the lowest layer?
---
Programming is like sex... Make one mistake and support it the rest of your life.
"AES, a strong encryption standard that passes muster with even the most paranoid security administrators."
If it's really secure, why does our favourite tree-letter-agency allow it for normal citizens? So much for paranoia...
All through the time I spent developing WLAN software, security was always the bottleneck. We always had to keep one thing at the back of our minds - if security isn't improved, all this work is gonna get flushed down the drain!
Fears about security have prevented WLAN from achieving all that it can potentially achieve. It was ridiculously easy for someone to break into a wireless LAN. 802.11i was seen to be the saviour, but the infighting among the various stakeholders always prevented the mechanisms defined under 802.11i from being accepted globally.
I hope things will change for the better now!
Is this new 802.11 product going to do well? With new technologies on the horizon such as WiMax will companies and businesses invest anymore money to upgrade or rollout an 802.11 product?
To be realistic, if you (as a programmer) are sending data that you know at the design stage that you want to keep private, you should be ancrypting it at the APPLICATION layer. If you are going to send data that you want transmitted securely, you shouldn't depend on the lower levels to do something which may or not be present. However, if you are using it as a way to keep unautorised user out of the network, you could do something similar by signing the packets as they are sent. This would cost you speed though, and it is easier to just encrypt with whatever cipher is in style at the time and check if the packet is valid.