802.11 Security

Problems with WEP

Unfortunately, the WEP specification within the 802.11 standard does not provide wired-equivalent privacy. There are many problems with WEP that greatly reduce its advertised security.

Key Management

The WEP standard completely ignores the issue of key management. This causes problems with WLANs as the number of users grows. Using pre-shared secret keys means that every client who has the key material must be fully trusted to use that material in a legitimate way. This level of trust is not realistic. If everyone on a network uses the same key, then anyone on the network can decrypt traffic intended for any other device on the network. Also, an uneducated but otherwise trustworthy user may give the key material to another person (i.e., a friend or business associate who has stopped by the office). This new user is outside the initial trusted group of individuals who were issued the key material and could potentially compromise the network.

As the number of WLAN users grows and time passes, the amount of trust placed in secrecy of the key declines. In order to overcome this reduced trust, keys must be rotated periodically to reset the network to a trusted level. WEP provides key enumeration to allow users and administrators to rotate through a set of pre-shared keys. However, this does not drastically increase the security of the network. Instead of one key being issued to users, several keys are issued at one time. All keys are still known by the users.

Vendors ...