Wpa Wpa2

Introduction

WPA (Wi-Fi Protected Access) and WPA2 represent critical standards for securing wireless local area networks (WLANs). Developed to address vulnerabilities in WEP, these protocols enhance confidentiality, integrity, and authentication. WPA introduced TKIP, a temporal key integrity protocol, while WPA2 adopted AES-based CCMP encryption aligning with 802.11i standards. Both protocols are foundational for contemporary wireless security frameworks.

"Wireless security is not a choice but a necessity in the age of ubiquitous connectivity." -- Radia Perlman

Wireless Security Overview

Fundamentals

Wireless networks transmit data over radio waves: susceptible to eavesdropping, spoofing, interception. Security goals: confidentiality, integrity, availability, authentication.

Legacy Protocols

WEP: early encryption standard, static keys, RC4 stream cipher, weak IV usage, trivial to crack.

Need for WPA/WPA2

WEP vulnerabilities demanded improved encryption, dynamic key management, robust authentication. WPA and WPA2 emerged as response.

WPA Architecture

Development and Adoption

Introduced 2003 by Wi-Fi Alliance as interim fix to WEP weaknesses. Backwards compatible with WEP hardware.

Core Components

TKIP: enhances RC4 with per-packet key mixing, MIC (Message Integrity Code), re-keying. 802.1X authentication support.

Key Features

Dynamic key generation, improved integrity checks, backward compatibility, user authentication via 802.1X/EAP.

WPA2 Architecture

Standardization

Ratified 2004 as IEEE 802.11i amendment. Mandatory AES-CCMP encryption replacing TKIP as default.

CCMP Encryption

Based on AES block cipher, Counter Mode Cipher Block Chaining Message Authentication Code Protocol. Strong confidentiality and integrity.

Robust Security Network (RSN)

Defines framework for key management, authentication, encryption negotiation between supplicant and authenticator.

Encryption Methods

TKIP (Temporal Key Integrity Protocol)

Dynamic key mixing, 128-bit keys, MIC for packet integrity, re-keying every 10,000 packets, RC4 cipher.

AES-CCMP (Advanced Encryption Standard - Counter Mode CBC-MAC Protocol)

128-bit AES key, counter mode encryption for confidentiality, CBC-MAC for integrity, block cipher operation.

Comparison

TKIP: backward compatible, weaker security. AES-CCMP: computationally intensive, stronger security, mandatory in WPA2.

Authentication Process

802.1X Framework

Authentication via RADIUS server, EAP methods, supplicant (client), authenticator (AP), authentication server components.

Pre-Shared Key (PSK)

Simplified mode for home/small networks, shared passphrase, no external server, vulnerable to dictionary attacks.

Four-Way Handshake

Key confirmation, nonce exchange, pairwise transient key (PTK) derivation, replay protection, mutual authentication.

Four-Way Handshake Steps:1. Authenticator -> Supplicant: ANonce2. Supplicant -> Authenticator: SNonce + MIC3. Authenticator -> Supplicant: GTK + MIC4. Supplicant -> Authenticator: Confirmation + MIC

TKIP vs AES

Security Comparison

TKIP susceptible to Michael MIC attacks, dictionary attacks, packet spoofing. AES resistant due to strong cryptographic primitives.

Compatibility

TKIP designed for legacy hardware, AES requires hardware acceleration, newer chipsets support AES natively.

Transition Strategy

Mixed mode operation supported for backward compatibility; however, AES-only preferable for security.

Vulnerabilities and Attacks

WPA Weaknesses

TKIP flaws: Michael MIC key recovery attacks, TKIP replay attacks, fragmentation attacks.

WPA2 Weaknesses

KRACK attack: key reinstallation vulnerability in four-way handshake, fixed by patches.

Mitigation Techniques

Firmware updates, use AES-CCMP, disable TKIP, strong passphrases, network segmentation, 802.1X authentication.

Enterprise vs Personal Modes

WPA/WPA2-Personal (PSK)

Single shared key, simple setup, vulnerable to offline attacks, suitable for small networks.

WPA/WPA2-Enterprise

Individual credentials, RADIUS backend, EAP authentication methods, enhanced security, scalable for organizations.

Use Cases

Personal: home, small offices. Enterprise: corporate, universities, government networks.

Performance Considerations

Computational Overhead

AES-CCMP requires more CPU resources than TKIP, impacting legacy devices.

Latency and Throughput

Encryption and decryption introduce minor latency; optimized hardware minimizes impact.

Power Consumption

Higher CPU usage affects battery life in mobile devices with AES.

Implementation Guidelines

Best Practices

Use WPA2-AES exclusively, disable TKIP, strong unique passphrases, deploy 802.1X where feasible.

Configuration Tips

Regular firmware updates, segregate guest networks, monitor for rogue devices, enable logging and alerts.

Compliance

Follow organizational policies, regulatory standards (e.g., HIPAA, PCI DSS), periodic security audits.

Future Trends

WPA3 Standard

Introduces Simultaneous Authentication of Equals (SAE), enhanced encryption, forward secrecy, protection against dictionary attacks.

Quantum-Resistant Algorithms

Research on integrating post-quantum cryptography into wireless standards for long-term security.

Integration with IoT Security

Adapting WPA protocols to resource-constrained IoT devices, improved key management, lightweight cryptography.

WPA3 SAE Authentication Algorithm:1. Password mapped to a scalar2. Peer ephemeral keys generated3. Diffie-Hellman key exchange performed4. Shared secret derived with forward secrecy5. Mutual authentication completed

References

• B. Aboba et al., "Extensible Authentication Protocol (EAP)," RFC 3748, 2004, pp. 1-51.
• N. Borisov, I. Goldberg, D. Wagner, "Intercepting Mobile Communications: The Insecurity of 802.11," ACM MobiCom, 2001, pp. 180-189.
• IEEE Std 802.11i-2004, "Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Amendment 6: Medium Access Control (MAC) Security Enhancements," IEEE, 2004.
• Mathy Vanhoef, Frank Piessens, "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2," ACM CCS, 2017, pp. 1313-1328.
• Wi-Fi Alliance, "Wi-Fi Protected Access: WPA and WPA2 Security Overview," White Paper, 2004, pp. 1-20.