book

Real 802.11 Security: Wi-Fi Protected Access and 802.11i

Name: Real 802.11 Security: Wi-Fi Protected Access and 802.11i
ISBN: 0321136209

by Jon Edney, William A. Arbaugh

July 2003

Intermediate to advanced

480 pages

12h 4m

English

Addison-Wesley Professional

Read now

Unlock full access

Copyright
Praise for Real 802.11 Security: Wi-Fi Protected Access and 802.11i
Preface
Why This Book Now?To Wi-Fi or Not to Wi-FiThe Cavalry Is HereAudienceOrganizationDisclaimer
Acknowledgments
I. What Everyone Should Know
1. Introduction
Setting the SceneRoadmap to the BookNotes on the Book
2. Security Principles
What Is Security?Good Security Thinking1. Don't Talk to Anyone You Don't Know2. Accept Nothing Without a Guarantee3. Treat Everyone as an Enemy until Proved Otherwise4. Don't Trust Your Friends for Long5. Use Well-Tried Solutions6. Watch the Ground You Are Standing on for CracksSecurity TermsSummary
3. Why Is Wi-Fi Vulnerable to Attack?
Changing the Security ModelWhat Are the Enemies Like?Gaming AttackersProfit or Revenge AttackersEgo AttackersTraditional Security ArchitectureOption 1: Put Wireless LAN in the Untrusted ZoneOption 2: Make Wi-Fi LAN TrustedDanger of Passive MonitoringSummary
4. Different Types of Attack
Classification of AttacksAttacks Without KeysSnoopingMan-in-the-Middle Attack (Modification)Attacks on the KeysOne-Time PasswordsBurying the KeysWireless AttacksAttacking the Keys Through Brute ForceDictionary AttacksAlgorithmic AttacksSummary
II. The Design of Wi-Fi Security

5. IEEE 802.11 Protocol Primer
LayersWireless LAN OrganizationBasics of Operation in Infrastructure ModeBeaconsProbingConnecting to an APRoamingSending DataProtocol DetailsGeneral Frame FormatsMAC headerManagement FramesTimestampBeacon IntervalCapabilities InformationSSIDSupported Data RatesRadio ParametersPower Save Flags (TIM)OthersRadio BitsSummary
6. How IEEE 802.11 WEP Works and Why It Doesn't
IntroductionAuthenticationPrivacyUse of RC4 AlgorithmInitialization Vector (IV)WEP KeysDefault KeysKey Mapping KeysMechanics of WEPFragmentationIntegrity Check Value (ICV)Preparing the Frame for TransmissionRC4 Encryption AlgorithmWhy WEP Is Not SecureAuthenticationAccess ControlReplay PreventionMessage Modification DetectionMessage PrivacyIV ReuseRC4 Weak KeysDirect Key AttacksSummary
7. WPA, RSN, and IEEE 802.11i
Relationship Between Wi-Fi and IEEE 802.11What Is IEEE 802.11i?What Is WPA?Differences Between RSN and WPASecurity ContextKeysSecurity LayersHow the Layers Are ImplementedRelationship of the StandardsList of StandardsPictorial MapSummary
8. Access Control: IEEE 802.1X, EAP, and RADIUS
Importance of Access ControlAuthentication for Dial-in UsersIEEE 802.1XIEEE 802.1X in a Simple Switched Hub EnvironmentIEEE 802.1X in Wi-Fi LANsEAP PrinciplesEAP Message FormatsEAPOLEAPOL-StartEAPOL-KeyEAPOL-PacketEAPOL-LogoffMessages Used in IEEE 802.1XAuthentication SequenceImplementation ConsiderationsRADIUS—Remote Access Dial-In User ServiceRADIUS MechanicsCore MessagesCore Message Format and AttributesAttributesEAP over RADIUSUse of RADIUS in WPA and RSNSummary
9. Upper-Layer Authentication
IntroductionWho Decides Which Authentication Method to Use?Use of Keys in Upper-Layer AuthenticationSymmetric KeysAsymmetric KeysCertificates and Certification AuthoritiesA Detailed Look at Upper-Level Authentication MethodsTransport Layer Security (TLS)Functions of TLSHandshake ExchangeClient Hello (client → server)Server Hello (server → client)Server Certificate (server → client)Client Certificate (client → server)Client Key Exchange (client → server)Client Certificate VerificationChange Connection StateFinishedRelationship of TLS Handshake and WPA/RSNTLS over EAPSummary of TLSKerberosUsing TicketsKerberos TicketsObtaining the Ticket-Granting TicketService TicketsCross-Domain AccessHow Tickets WorkUse of Kerberos in RSNCisco Light EAP (LEAP)Protected EAP Protocol (PEAP)Phase 1Phase 2Status of PEAPAuthentication in the Cellular Phone World: EAP-SIMOverview of Authentication in a GSM NetworkLinking GSM Security to Wi-Fi LAN SecurityEAP-SIMStatus of GSM-SIM AuthenticationSummary
10. WPA and RSN Key Hierarchy
Pairwise and Group KeysPairwise Key HierarchyCreating and Delivering the PMKComputing the Temporal KeysExchanging and Verifying Key InformationMessage (A): Authenticator → SupplicantMessage (B): Supplicant → AuthenticatorMessage (C): Authenticator → SupplicantMessage (D): Supplicant → AuthenticatorCompleting the HandshakeGroup Key HierarchySummary of the Key Establishment ProcessKey Hierarchy Using AES–CCMPMixed EnvironmentsSummary of Key HierarchiesDetails of Key Derivation for WPAFour-Way HandshakeMessage (A): Authenticator → SupplicantMessage (B): Supplicant → AuthenticatorMessage (C): Authenticator → SupplicantMessage (D): Supplicant → AuthenticatorGroup Key HandshakeNonce SelectionComputing the Temporal KeysSummary
11. TKIP
What Is TKIP and Why Was It Created?TKIP OverviewMessage IntegrityIV Selection and UseIV LengthIV as a Sequence Counter—the TSCCountering the FMS AttackPer-Packet Key MixingTKIP Implementation DetailsMessage Integrity—MichaelCountermeasuresMIC Failure at Mobile DeviceMIC Failure at Access PointComputation of the MICPer-Packet Key MixingSubstitution Table or S-BoxPhase 1 ComputationPhase 2 ComputationSummary
12. AES–CCMP
IntroductionWhy AES?AES OverviewModes of OperationElectronic Code Book (ECB)Counter ModeCounter Mode + CBC MAC : CCMOffset Codebook Mode (OCB)How CCMP Is Used in RSNSteps in Encrypting a TransmissionCCMP HeaderOverview of ImplementationSteps in Encrypting an MPDUComputing the MICEncrypting the MPDUDecrypting MPDUsSummary
13. Wi-Fi LAN Coordination: ESS and IBSS
Network CoordinationESS Versus IBSSJoining an ESS NetworkWPA/RSN Information ElementValidating the Information ElementsPreauthentication Using IEEE 802.1XIBSS Ad-Hoc NetworksSummary
III. Wi-Fi Security in the Real World
14. Public Wireless Hotspots
Development of HotspotsPublic Wireless Access DefinedBarriers to GrowthFax Machine ProblemMultiparty BarrierModel 1: Wireless Internet Service ProviderModel 2: Brand-Based Service ProviderModel 3: Cellular Operator Extension ServiceSecurity Issues in Public HotspotsHow Hotspots Are OrganizedSubscribersAccess PointsHotspot ControllersAuthentication ServerDifferent Types of HotspotsAirportsHotelsCoffee ShopsHomesHow to Protect Yourself When Using a HotspotPersonal Firewall SoftwareVirtual Private Network (VPN)VPN DetailsSummary
15. Known Attacks: Technical Review
Review of Basic Security MechanismsConfidentialityCryptographyAsymmetric EncryptionSymmetric EncryptionKey ManagementAccess ControlIntegritySource IntegrityData IntegrityMessage Authentication CodesDigital SignaturesReview of Previous IEEE 802.11 Security MechanismsConfidentialityRC4 and WEPInitialization VectorIntegrity Check ValueWEP Datagram FormatKey ManagementAccess ControlIntegrity and AuthenticationOpen System AuthenticationShared-Key AuthenticationAttacks Against the Previous IEEE 802.11 Security MechanismsConfidentialityRC4 ProblemsMantin and Shamir Bias FlawFluhrer, Mantin, and Shamir Key Schedule AttackOther WEP ProblemsIV SpaceReplay AttacksWEP Message ModificationAn Active Implementation of Fluhrer, Mantin, and ShamirAn Inductive Chosen Plaintext AttackBase PhaseInductive PhaseMTU RecoveryBuilding the DictionaryCost of the AttackEffects of Filtering IVsAccess ControlProblems with MAC-Based Access Control ListsProblems with Proprietary Closed Network Access ControlAuthenticationShared-Key AuthenticationMan-in-the-Middle AttacksManagement FramesARP SpoofingProblems Created by Man-in-the-Middle Attacks802.1x and EAPPEAPDenial-of-Service AttacksLayer 2 Denial-of-Service Attacks Against All Wi-Fi-Based StandardsWPA Cryptographic Denial-of-Service AttackSummary
16. Actual Attack Tools
Attacker GoalsProcessReconnaissanceNetStumblerKismetExample ScenariosPlanningWideOpenLockedUpCollectionAnalysisRecovery of WEP KeyPassive Identification of Network ParametersExecutionOther Tools of InterestAirsnortAirjackDoS AttackESSID DeterminationMan-in-the-Middle AttackSummary
17. Open Source Implementation Example
General Architecture Design GuidelinesProtecting a Deployed NetworkIsolate and CanalizeUpgrade Equipment's Firmware to WPAWhat to Do If You Can't Do AnythingPlanning to Deploy a WPA NetworkDeploying the InfrastructureAdd a RADIUS Server for IEEE 802.1X SupportUse a Public Key Infrastructure for Client CertificatesInstall Client IEEE 802.1X Supplicant SoftwarePractical Example Based on Open Source ProjectsServer InfrastuctureOpenSSL Instead of a PKIDownloading OpenSSLCompiling OpenSSLConfiguring OpenSSLMaking the Public Key CertificatesCreating the Certificate AuthorityCreating a Server CertificateCreating a Client CertificateRADIUS SoftwareDownloading FreeRADIUSCompiling FreeRADIUSConfiguring FreeRADIUSclients.confradiusd.confusersTesting FreeRADIUSBuilding an Open Source Access PointAP HardwareAP SoftwareOpenBSDLinuxMaking It All WorkConfiguring Cisco Access Points to Use 802.1XSetting the RADIUS Server PropertiesClient SoftwareWindows XPInstalling Public Key CertificatesWireless Device ConfigurationSummaryAcknowledgmentsReferences and More Information
Appendixes
A. Overview of the AES Block Cipher
Finite Field ArithmeticAdditionSubtractionMultiplicationDivisionGalois Field GF()ConclusionSteps in the AES Encryption ProcessRound KeysComputing the RoundsSubBytesShiftRowsMixColumnsXorRoundKeyDecryptionSummary of AES
B. Example Message Modification
Example Message Modification
C. Verifying the Integrity of Downloaded Files
Checking the MD5 DigestChecking the GPG Signature
Acronyms
References

Content preview from Real 802.11 Security: Wi-Fi Protected Access and 802.11i

References

[biblio01entry01] Abaddon. July 2002. Airjack. http://802.11ninja.org,

[biblio01entry02] B., Aboba, and D. Simon. 2001. IEEE 802.11 security and 802.1X. IEEE 802.11-00/034r1.

[biblio01entry03] D., Abraham, G. Dolan, G. Double, and J. Stevens. 1991. Transaction security system. IBM Systems Journal 39: 206–229.

[biblio01entry04] Advanced Encryption Standard (AES). <year>2002</year>. Technical Report FIPS 197. U.S. National Institute of Standards.

[biblio01entry05] air. www.sourceforge.net/projects/airsnort.

[biblio01entry06] R. Anderson, <year>2001</year>. Security Engineering. New York: John Wiley and Sons.

[biblio01entry07] W.A. Arbaugh, May 2001. An inductive chosen plaintext attack against WEP/WEP2. www.cs.umd.edu/waa/wepwep2-attack.html ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Wireless Network Security A Beginner's Guide

Publisher Resources

ISBN: 0321136209Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Real 802.11 Security: Wi-Fi Protected Access and 802.11i

by Jon Edney, William A. Arbaugh

References

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.