Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Wireless Networking Encryption Security Hardware

IEEE Approves 802.11i 302

Posted by michael from the my-lock-my-key dept.
Dozix007 writes "IEEE has approved a new wireless security protocol dubbed 802.11i, intended to finally provide sufficient security for wireless connections that users don't need to rely on alternate security layers. The new specification works by using AES encryption in the transceiver itself, encrypting data directly at the level just above the actual radio pulses themselves. That makes it transparent for applications sending data through the radio, so legacy programs running on new 802.11i-compliant hardware will automatically get the benefits of the new protocol without the need for modification."
This discussion has been archived. No new comments can be posted.

IEEE Approves 802.11i More

IEEE Approves 802.11i

Comments Filter:

  • Sure but does it require new equipment (Score:4, Interesting)

    by Bruha ( 412869 ) on Friday June 25, 2004 @02:51PM (#9531681) Homepage Journal
    Or can I do a firmware upgrade on my Linksys WRT54GS.

    $$$$ Dude.

    • Re:Sure but does it require new equipment (Score:5, Informative)

      by spellraiser ( 764337 ) on Friday June 25, 2004 @03:22PM (#9532023) Journal

      Well, since encryption only involves standard processing, a firmware upgrade should be all that's required. Don't see any reason why a device would need to be created specifically for 802.11i. This is also interesting (taken from here [dailywireless.org]):

      Cisco, one of the largest providers of enterprise APs, said AES is supported in hardware on the IEEE 802.11g versions of AP models 1100, 1200, and the newly announced 1300 outdoor AP/bridge. However, a software upgrade for those devices will be required. Software upgrades will also be available for 802.11a, b and g card-bus and NIC cards.

      Although they don't state it explicitly, it's a pretty fair bet that firmware upgrades for Linksys APs will be available at some point.

      • Re:Sure but does it require new equipment (Score:5, Insightful)

        by paranode ( 671698 ) on Friday June 25, 2004 @03:47PM (#9532229)
        Don't see any reason why a device would need to be created specifically for 802.11i.

        Ah, that would be because corporations are greedy. Sure they could give you a firmware upgrade, but they could also peddle a completely new product that costs you money.
        • Being inept can also be an issue. With Linksys's 802.11b wireless routers(the BEFW11S4 series), they only attempted to even implement WPA on the v4, and that implementation doesn't reliably work, even though it's entirely possible to get it reliably working on all 802.11b equipment. For a lot of these routers, just getting them to work well with the company-custom firmware is hard enough; for new features, they might as well let their chipset supplier(Broadcom, etc) take care of it, and roll the stuff in to

        • OSS to the rescue(?) (Score:4, Interesting)

          by timeOday ( 582209 ) on Friday June 25, 2004 @04:51PM (#9532818)
          If we're lucky anyways.

          The HostAP [epitest.fi] driver does encryption in software.

          My home server is (among other things) a wireless access point. The card I have is a few years old and doesn't support WEP at all, but thanks to this driver it does! In fact it also supports a bunch of other security features for encryption and authentication, which I have not delved into.

          That said, it sounds like this new encryption may be at a lower level, which for all I know may necessitate new firmware.

        • I wouldn't really count Linksys on that bandwagon yet. They've been really good about keeping their firmware up to date even on old devices. If you have any of their "G" products and even some of the not-too-old 802.11b ones, they've provided updates that now include WPA instead of just WEP.

          Linksys usually keeps their products updated to the latest capabilities within two years, and past that they still provide bug fixes.

          This new encryption thing might be different and/or it might require new hardware

          • I wouldn't really count Linksys on that bandwagon yet. They've been really good about keeping their firmware up to date even on old devices.

            Bullshit. They drop support just about as soon as they can. I've got a first-gen WPA11 for which linksys never released a single firmware update and which never had a reliable driver. I've also got a WAP11 that's in the same boat. You may be confused by the fact that linksys generally keeps the same name when they change the chipset on their products. So they have upda

    • The conventional wisdom has been that most cheap Wi-Fi gear wasn't built with enough spare cycles to do AES at network speeds, so new hardware would be needed. Another respondent said Ciscos would be just a firmware upgrade, and I could believe that their enterprise boxes have the CPU capacity.

      Security advice for the non-technical: http://besphere.blogspot.com

    • Re:Sure but does it require new equipment (Score:5, Insightful)

      by tmasssey ( 546878 ) on Friday June 25, 2004 @03:43PM (#9532206) Homepage Journal
      Three things:

      1) It's not likely that the 200MHz CPU in that thing is going to handle 54Mbit worth of traffic. AES is not the easiest to calculate...

      2) Even so, it's highly likely that a firmware update could *possibly* add this. Will Cisco? My guess is no: they are not incented to make your current device more useful. They'd rather sell a new device.

      3) The beauty of OpenSource is that you can add whatever features you want... [seattlewireless.net]

      • It's not likely that the 200MHz CPU in that thing is going to handle 54Mbit worth of traffic. AES is not the easiest to calculate...

        On x86, AES can be done in under 25 clock cycles per byte, so if that is an x86, a 200 MHz CPU could handle 54 mbit/second, although it wouldn't leave much for other stuff.

        • Re:Sure but does it require new equipment (Score:5, Insightful)

          by tmasssey ( 546878 ) on Friday June 25, 2004 @04:14PM (#9532521) Homepage Journal
          According to this article [commsdesign.com], the speed of encryping 128 bits of data with a 128-bit AES key is 730 cycles on a 32-bit MIPS processor. To keep it consistent with your numbers, that's actually >45 cycles/byte. At approximately 5 Million bytes/sec (54Mbit wireless), and 45 cycles/byte, that's 225 Million cycles per second right there. IIRC, the processor that's embedded in the router has a single pipeline at 200MHz, or, at best, 200 MIPS.

          In other words, assuming *zero* processing overhead, we're 25 MIPS short for wire-speed encryption.

          These are very rough numbers, but think of it this way: do you think Cisco (or whoever) spec'ed a processor substantially faster than what they needed? From my peronal experience, embedded processors do not usually have more than a few percent more performance than they need: rarely do they have even 30% more performance than they need. Even if they design a system with a way-fast processor, one of two things happen: their code bloats to use that speed (or they quit optimizing because they don't need to), or they end up buying a lower-cost, slower processor for production!

          In short, it's highly unlikely that the Wrt54g will have anywhere near the CPU power to do wire(less)-speed AES at 54Mbit. Half that? Maybe, but not all of it.

    • Yes, says this guy here [ibm.com].

      Synopsis: All new kit to have embedded encryption co-processors, available September. Throw the old stuff away.

  • Oh no another wireless radio wave flying through the air! Oh well maybe I can pic up the internet if i tune my radio just right!

  • Ah Finally! (Score:4, Insightful)

    by scosol ( 127202 ) on Friday June 25, 2004 @02:52PM (#9531696) Homepage
    "sufficient" security- hahahahah history teaches us nothing apparently

    • Re:Ah Finally! (Score:5, Funny)

      by nazsco ( 695026 ) on Friday June 25, 2004 @03:01PM (#9531799) Journal
      encription in EVERY protocol layer and then some encription in the software, that's runing trhu ssh... so i can safely read my mail that i protected with my birtday as the password.

      • Re:Ah Finally! (Score:5, Funny)

        by Kymermosst ( 33885 ) on Friday June 25, 2004 @05:17PM (#9533004) Journal
        encription in EVERY protocol layer and then some encription in the software, that's runing trhu ssh... so i can safely read my mail that i protected with my birtday as the password.

        I'd say your spelling problems provide enough encryption at the user level.

    • Even the best security is only sufficient. Eventually, everything can be cracked. Eventually, enough computing power will be available to make today's encryption algorithms useless. But eventually, security options will be sifficiently better to protect those that want it.
      -N
  • Even if I is going to be the new wireless standard, there is going to be many years until it becomes it. G was supposed to become the new standard, and I am rarely in a situation where my Powerbook picks up a G signal.

    Does anyone have any figures on how long between products get rolled out until inception in the digital world? I would be curious to see the timeliens of some products such as: 3.0megapixel cameras, DSL/Cable, 802.11b/g, etc.

    GroupShares Inc. [groupshares.com] - A Free and Interactive Investment Community

    • Lack of equipment or how it's supposed to work? (Score:4, Insightful)

      by swb ( 14022 ) on Friday June 25, 2004 @02:57PM (#9531744)
      IANA wireless expert, but isn't one of the annoying gotchas of 802.11g that the presence of a B client drops all connected nodes down to B speeds?

      If I'm remembering that right, then what you're experiencing may not be a lack of standards uptake -- you could be connecting to a ton of 802.11g stations, but somebody's got a B card running.

      • No (Score:4, Informative)

        by billybob ( 18401 ) on Friday June 25, 2004 @03:30PM (#9532092)
        I have a netgear wireless router that does G and B. It can handle both at the same time just fine, and does not drop the G down to B speeds if there is a B client. :)

        Maybe some routers do this, honestly I wouldnt be surprised, but I'm just letting you know that mine doesn't.

        • Re:No (Score:4, Informative)

          by scd ( 541350 ) <scottdp AT gmail DOT com> on Friday June 25, 2004 @03:39PM (#9532170)

          The actual issue is that some of the 802.11 protocol has to be done at speeds that all possible connecting units can understand. What this amounts to is that 'handshaking' is done at B speeds to allow B units to communicate, while the actual data transfer for G units is done at G speeds.

          This causes some slowdown for G units. If an access point has proper settings, you should be able to make it do G only, thereby speeding up all G units at the expense of disallowing B units from connecting at all.

          At least, the 802.11 protocol allows this, don't know if APs do or not.

      • The Conexant (who bought wireless off Intersil) Prism54 chipset has a feature called 'Nitro' mode which allows b and g clients to work together in the same environment.

        I don't think the chipset is as widely used as it's 802.11b counterpart, the Prism 2 though.

    • thats probably because for most purposes B is fine. i mean who is going to spend more on G when typical internet speeds never even reach 11Mps? G maybe is fine for the office or home where you are talking to local servers or other clients, but starbucks doesnt need more than a B.

    • I am rarely in a situation where my Powerbook picks up a G signal.

      That's why you make a G signal.

      For internet access spots, B should do fine.

      The idea is to get a more recent standard such that when it gets widely adopted, you are ready for it, rather than having to upgrade or add cards when it does become popular.
    • "G was supposed to become the new standard, and I am rarely in a situation where my Powerbook picks up a G signal."

      G recently became rather affordable. Just a few days ago I bought a wireless router using G. It was only $10 more expensive than B. I figured what the hell?

      I doubt you'll find G at public places, though. Little need for it since it isn't so popular to do transfers that require the megabits range.

  • It's about time... (Score:5, Interesting)

    by Shoeler ( 180797 ) on Friday June 25, 2004 @02:54PM (#9531714)
    Hopefully the approval of the standard will reel in the multiple competing vendor solutions that have been out there. From Cisco's LEAP to TKIP (Aka WEP2), most still would not encrypt things like the MAC address or ESSID. For companies who are actually security-minded and wouldn't deploy wireless without a truely secure standard, this should be their open door to some real mobility.

    Now if only I can convince my employer so I can use Trillian to get me through those boring meetings. :)

    • MAC encryption (Score:2, Informative)

      by m0rningstar ( 301842 )
      From what I can read on the NIST 802.11 overview it's still not designed to protect identity.

      Thus it will still not encrypt ESSID (used as a clue for what encryption credentials you need, NOT as a security measure) or the MAC address of the systems using it. (Page 29 of the above referenced article).

      It's designed to address two of the three of the CIA principles, those being confidentiality and integrity of your data. Not to hide who is on the wireless network.

  • Suspicious (Score:5, Funny)

    by gUmbi ( 95629 ) on Friday June 25, 2004 @02:55PM (#9531724)
    What happened to 802.11h? Was it brushed under the rug by the NSA? The CIA? The Bush family?

    Get out the tin foil hats boys, this is a big one.
    • You think that's big, what about 802.11c through 802.11f?

      This one calls for a freaking tin foil *bodysuit*.
      • You think that's big, what about 802.11c through 802.11f?


        This one calls for a freaking tin foil *bodysuit*.


        The Bush Administration flew them out of the country back to Saudi Arabia.

        This is either going to be modded really high or really low. Unless no one saw Fahrenheit 9/11, in which case I'm screwed.

    • Some fool... (Score:2, Funny)

      by Anonymous Coward
      ... wrote the RFC using IPv5.

  • awesome (Score:5, Insightful)

    by joel2600 ( 540251 ) on Friday June 25, 2004 @02:55PM (#9531726) Journal
    Now try explainging to regular people the difference between a/b/i/g/x and which ones work together, which ones don't and why.

    i hope the guys at best buy are up to speed to direct the consumers!

    • Re:awesome (Score:2, Funny)

      by hackstraw ( 262471 ) *
      Its clear. a/b/g are transmition protocols. /i and /x are security protocols /a can be faster than /b, but not necessarily faster than /g /a is usually compatable with /b stuff, /g stuff is usually compatable with /a and /b. something labeled as /a or /b will probably work with a /g at some negotiated speed

      I could care less about /i and /x, I do my own encryption, thank you very much
    • Don't forget 802.11d, which is country code, channel, and power mappings. Of course.
    • best buy doesn't support end users

      it'll be you explaining the differences and doing the troubleshooting

      enjoy

  • 802.11h? (Score:5, Funny)

    by BoldAC ( 735721 ) on Friday June 25, 2004 @02:56PM (#9531737)
    I hope this means that everybody is respecting my patent for 802.11h--which is, of course, packet transmission by horsepack. We are also trying to teach dolphins... the squeaks are tough to error correct. :(

    • Indeed, horsepack is a very strong wireless method. It's powerful, but it's also resource consuming. You have to power it with hay, and the maintenance is demanding. It's not as fast as other wireless protocols, but the pipe is huge. And the range is much better than any of our existing methods - horses can travel over hundreds of miles. Unfortunately, line of sight isn't quite enough for the packets to get there.

      Pinging www.slashdot.org via 802.11horse...
      Response received in 32 days, 4 hours, 7 minutes, 5

  • The i stands for... (Score:4, Funny)

    by calebb ( 685461 ) * on Friday June 25, 2004 @02:56PM (#9531738) Homepage Journal
    The i is for incryption! [groan]

    Hey, if you don't think anyone makes that spelling mistake, check out this link! [google.com]

  • Firmware (Score:4, Interesting)

    by kinzillah ( 662884 ) <{ude.tir.liam} {ta} {ecirp.salguod}> on Friday June 25, 2004 @02:56PM (#9531739)
    Is there any news on if this will be available as a firmware update for existing equipment? Or will our access points not have the required processing power to handle it?

    If thats the case, running a VPN over the wireless may still be the best option.

  • Is this really a good thing? (Score:5, Insightful)

    by kabocox ( 199019 ) on Friday June 25, 2004 @02:58PM (#9531754)
    I know some seemless intergrated security is better than having it tacked on afterward. I've always felt that if folks trusted a default security layer to be perfect, they will get burned when the defaul layer is broken. You should always have application encryption of important data. You shouldn't just trust that your pipe will be encrypted. Sometimes those pipes get used by unauthorized third parties that's when having everything else encrypted comes in handy. I'm just afraid folks will switch to the 802.11i and not bother to encrypt any of their data.

  • Change hardware *again*? No thanks (Score:4, Insightful)

    by jeffmeden ( 135043 ) on Friday June 25, 2004 @03:00PM (#9531786) Homepage Journal
    That makes it transparent for applications sending data through the radio, so legacy programs running on new 802.11i-compliant hardware will automatically get the benefits of the new protocol without the need for modification.

    And exactly 0% of the hardware will be backwards compatible. Who trusts data privacy flying across a network anyway? Isnt that what we have VPN, SSH, HTTPS, etc. for? IMHO we have more things to concern ourselves with, like interference countermeasures, signal efficiency, etc. Who is going to switch to a new hardware platform just because it offers a different (read: not necessarily better) encryption method?

  • This is terrible news (Score:5, Funny)

    by piecewise ( 169377 ) on Friday June 25, 2004 @03:00PM (#9531788) Journal
    More security and more awareness for security means that I won't be able to leach off my neighbor's wireless and in turn that means I will not be able to sit on the toilet with my PowerBook and in turn that means I will have to stretch Ethernet clear across into the bathroom and THAT can create a fire hazard.

    Need I say more.

  • Let's hope 802.11 stops soon (Score:4, Funny)

    by FerretFrottage ( 714136 ) on Friday June 25, 2004 @03:02PM (#9531803)
    ...because once we get to 802.11l we're really going to be screwed and nevermind the marketing nightmares.

    Sample tech support eamil exchange
    "I'm having problems with my 802.11l wireless router"

    "Did you say 802.111?"

    "No, 802.11l"

    "That's what I said"

    "No, you said 802.111, that's not due out til next month according to /."

    "Sorry sir, so you have our 802.11/. router?"
  • Why can't they just settle on one standard and go from there?
    • Why can't they just settle on one standard and go from there?

      That's essentially what's happening already. They settle on a standard, people adopt it. The trouble comes with the "go from there" part. Whenever you "go" anywhere new with a standard, the old stuff is non-compliant, thus requiring a new standard.

  • Until recently, some people advocated IPSec over wi-fi as a stop-gap solution. But that's just that: A stop-gap. I for one am glad to see that the standard takes into consideration lower layer security (and tosses WEP out the window).

    • Re:Better than IPSec over wi-fi... (Score:4, Insightful)

      by Abcd1234 ( 188840 ) on Friday June 25, 2004 @03:24PM (#9532033) Homepage
      How is that a stop-gap? IPSec has one purpose: to protect IP traffic data over an insecure link. Sounds like it fits right into the wifi game. And given that it's a proven standard with many interoperable implementations, it still strikes me as an excellent option for people who wish to secure their wireless transmissions. This is especially true given that 802.11i won't be fully adopted in the market place for at least a year or two.

      Besides, there are *many* issues regarding security aside from the wire protocol. As one other posted mentioned, key management is one of these issues. How does 802.11i deal with this? I know IPSec has many different solutions available for key management, meaning I can make it fit into my network infrastructure. How does 802.11i fit into this picture?
      • Quite, most importantly because it's rare that you make a purely wireless connection to a remote host.

        IPSEC means encrypted end-to-end, not just over the wireless segment of the network.

        All this faffing with wireless-specific encryption is just a stopgap until we get broad adoption of IPSEC or similar.
        • Bad form to reply to my own post but the other side of the coin just slapped me in the face.

          The downside of broad adoption of encryption technologies is that it makes the job of protocol analysis (when finding bugs) nearly impossible.

          There are several occasions when I've had to take tcpdumps to identify a bug in a vendor's product (IBM WebSphere! Shoddy! well, getting better now). When the traffic's encrypted, the games a bogey, unless application-layer tools exist to dump the protocol details.
        • IPSEC means encrypted end-to-end, not just over the wireless segment of the network.

          Umm... no. IPSec just means encryption between two IP route points. So, for example, the plan for my wireless network involves an IPSec connection between any wireless end-points and my IPSec-enabled firewall.

  • Poor Starbucks (Score:4, Funny)

    by Anonymous Coward on Friday June 25, 2004 @03:10PM (#9531895)
    What the hell am I supposed to do at starbucks now If I can't sit around and sniff wirelessness??. Read the newspaper?!?!?!

  • Key Management (Score:5, Interesting)

    by provolt ( 54870 ) on Friday June 25, 2004 @03:11PM (#9531902)
    Did anyone else notice that there was no mention of key management? Who cares what algorithm it uses if there isn't secure key management. AES is a good choice for the encryption algorithm, but it might as well be plaintext if the key managment isn't handled properly.

    Is they key negotiated as part of the protocol? How is that exchange authenticated? How is access control done? Can anyone enter the network?

    Does it use a pre-placed key? How do you make sure the AP has every clients key? Can you access the AP without encryption? Do users have to type keys in?

    • It Depends, but one of the options is called Pre-Shared Keys or PSK, and that involves typing a passphrase into the units, and the over-the-air protocol turns out to be vulnerable to dictionary attacks.

      I fearlessly predict that some of those passphrases will be chosen poorly.

      Security advice for your Aunt Tillie and Cousin Homebuilder: http://besphere.blogspot.com.

    • Re:Key Management (Score:3, Insightful)

      by DdJ ( 10790 )
      I'll be really shocked if it works in a way fundamentally different, from a user experience standpoint, than today's systems.

      This means I'd bet someone $20 that it'll use a single shared key across the entire network, and client machines will obtain it from a user-entered password.

      But since it uses AES, all sorts of people will get excited and believe it's secure.

      So I see this as little more than a marketing ploy.

      Is it more secure than WEP and WPA? Yes. Yes, it's more secure, because in order to get t

    • Re:Key Management (Score:5, Informative)

      by DeathBunny ( 24311 ) on Friday June 25, 2004 @03:58PM (#9532356)
      802.11i includes the 802.1x (ie. EAP) authentication and key management included in WPA. It's a superset of WPA.
  • My router claims to be firmware-upgradeable to 802.11i/AES 'when the time comes,' but what about other stuff? If given the option, I would a sufficiently upgradeable AP or wireless NIC. It seems that only routers have enough CPU horsepower to spare to do be indefinitely upgradeable, but could I be wrong?

  • Does this finally solve the *other* major problem? (Score:3, Interesting)

    by ConsumedByTV ( 243497 ) on Friday June 25, 2004 @03:14PM (#9531935) Homepage
    You know, the one that makes it that anyone on the wifi network can see all the other traffic?

    I personally think a HUB is still a bad idea, even if the main transports are encrypted to the outside. The insider doesn't need to be able to see anyones traffic unless it's repeated to the target. It would be great if it was encrypted and acted like a switch.

    I would still use my VPN with this.
    • so, how exactly do you propose we do a separate physical wire over radio? and don't give me a set-frequency-per-endpoint response, because that doesn't address the scan-all-frequencies-and-listen approach.

      i'm not trolling here, i'm really wondering.

    • You know, the one that makes it that anyone on the wifi network can see all the other traffic?

      I can't help but think that you don't know what you're talking about. The whole nature of RF is that if one person can receive the radio waves, so can several other people. You can't just select a single point to broadcast to. Sure, you can make sure that those RF waves are encrypted, and that's what this standard does. However, it's physically impossible to keep other parties from receiving the encrypted wav

    • Yes, it does solve this problem. Since every wireless client (insider as you call it) is using a different key, one client can't decrypt another's traffic.

      The key is negotiated at authentication time and is valid only for the given client and sesion. Without the client's authentication credential (certificate or otherwise), you can't get a hold of the key.

  • OK, but how does it actually work (Score:5, Insightful)

    by mamba-mamba ( 445365 ) on Friday June 25, 2004 @03:14PM (#9531943)
    You can't just say oh, it uses AES. AES is a symmetric cipher, which implies that there is a shared session key.

    How do the nodes generate and exchange a shared session key? Or do you have to enter an AES key manually before you even hook up? That would certainly lock down the node!

    It would be nice if someone posted a link explaining at a medium level how it actually works. I don't want to just go read a draft of the standard, but I wouldn't mind reading a few of the important details.

    MM
    --

    • Re:OK, but how does it actually work (Score:5, Informative)

      by j h woodyatt ( 13108 ) <jhw@conjury.org> on Friday June 25, 2004 @03:45PM (#9532218) Homepage Journal
      I am a wireless expert.

      802.11i uses AES for privacy, HMAC-SHA1 for integrity, and it defines its own protocol for establishing transient unicast and group session keys. You can use it with a pre-shared master key (derived from a simple passphrase), or you can use it conjunction with 802.1X and get per-user pairwise master keys derived from the authentication service.

      The Wi-Fi Alliance (I'm told) is calling 802.11i by the name WPA2. If you have hardware that supports the AES variant of WPA, then your vendor should be able to supply a firmware upgrade soon that will support WPA2.
    • How do the nodes generate and exchange a shared session key? Or do you have to enter an AES key manually before you even hook up?

      You would not have to ask this question if you had even a basic understanding of cryptography.

      The Diffie-Hellman [postdiluvian.org] key agreement protocol is well known and very secure.

      Alternatively, it could be done how SSL does it: use a public-key method to exchange the symmetric-key cipher keys. You didn't actually think SSL sent all the data through a public-key cryptosystem, did you?

      P

  • In related news... (Score:5, Funny)

    by genka ( 148122 ) * on Friday June 25, 2004 @03:20PM (#9532002) Homepage Journal
    Apple anounced it's own version, called i802.11

  • Now I'm confused. (Score:2, Insightful)

    by JayJay.br ( 206867 )
    Maybe I do not have enough knowledge to know shit about this, but it looks to me that this is a standard for encryption, and it obviously would be public key encryption, and transceivers would exchange public keys to talk.

    While this clearly means that now no one can sniff the SSID, is this going to be any better for those who leave it at the default? And without any kind of MAC authentication or network protection at upper levels, would knowing the SSID the only difficult imposed against abuse of the netwo

    • Re:Now I'm confused. (Score:4, Interesting)

      by David Byers ( 50631 ) on Friday June 25, 2004 @04:31PM (#9532677)
      Stupid admins can mess anything up.

      IEEE 802.11i uses AES, which is not a public key algorithm, but it does provide for a key exchange process which can be based on public key cryptography (but doesn't have to be).

      As for hiding the SSID, I question the accuracy of tha article. It doesn't tally with what I've read about 802.11i over the last year. I don't think 802.11i provides for encryption of the entire frame any more than WEP or WPA does, and AFAIK it doesn't provide any security for management frames, so the SSID should still be in the open.

      MAC-based authentication is useless for deterring a serious attacker, but 802.11i provides for 802.1x port-based authentication, which typically will operate at the user level.

      Although 802.11i provides for generating the master key on-the-fly, I suspect that many installations (expecially home networks) will use pre-shared keys, which are usually hashed passwords and thus vulnerable to dictionary attacks.
  • I don't think the problems with previous wireless security systems were with the block ciphers used.

    The hard part in practical cryptography is not the block ciphers (there are plenty of those to choose from, off the shelf, that are good--AES, RC4, Twofish, Serpent, triple DES, etc). The hard part is using them properly--picking an appropriate mode, key management, padding, and stuff like that.

    • One of the most serious problems with WEP was the presence of weak keys in RC4. To make a long story short, an attacker could exploit these to discover the WEP key.

      With better protocol design, the problem would have been avoided, but the fact is that there WAS an exploitable weakness in the ciper that was used.

      By the way, RC4 is a stream ciper, not a block cipher.
  • Anyone ever heard of the end-to-end argument?

    Putting encryption at this level is useless because secure communication with e.g. a webserver still requires that I encrypt over HTTPS, since my link to the server goes over more than just the wireless link. Thus, hardware AES only duplicates functionality. This is one of the premises of the end-to-end argument: put functionality at the highest layer possible to avoid duplication.

    The argument that this is useful to keep "baddies" out of your network is weak,
    • In mountaineering, it is very common to place "protection" (anchors in the rock) even when it isn't obvious whether they will hold or not.

      Suppose you've got a really good placement (what a climber would call a "bomber" anchor) and you're sure it will hold. Do you place another, potentially less secure anchor in parallel, given the opportunity? Of course you do. You never pass up the chance to add a layer of protection. Even if you don't think it will be needed, and especially even if you don't think it wi

      • I still have some interrogations concerning the psychological effects ...

        I wonder if the data transmitted will feel more secure with a bad protection and will avoid being eavesdropped ;)

        not to contradict you, but making analogies isn't always a good idea ... information wants to be free but is brainless ...

    • Re:hardware-level encryption = crap (Score:4, Informative)

      by NerveGas ( 168686 ) on Friday June 25, 2004 @04:29PM (#9532653)
      If you want to keep your wireless network secure, tie MAC addresses to IP addresses, and presto!

      Presto, you're screwed? What keeps a "baddie" from sniffing your traffic, waiting until you're not on, then changing his MAC address to be the same as yours? Oh, gee... I guess that doesn't buy you very much, either.

      Even if it did, that still doesn't keep them from *sniffing* your network. Any data you transmit, they have. Just checked your email? Chances are they have your password. And all of those pictures that your girlfriend sent to you in those pictures. And those are just benign examples.

      Putting encryption at this level is useless because secure communication with e.g. a webserver still requires that I encrypt over HTTPS

      Until *every* protocol that goes over your network has reliable encryption, then this is still useful.

      steve

  • wait for 802.11n (Score:2, Informative)

    by timts ( 766509 )
    I saw it on maximumpc, it's going to be introduced and it will be efficient at compression, making the real transportation faster than 100MBytes even at further distance. :D
  • How long do you think it will be until retail-ready devices support .11i out of the box?

    How long until the AP is $80 at Fry's (like current models), and cards are also cheap?

Slashdot Top Deals

Put your Nose to the Grindstone! -- Amalgamated Plastic Surgeons and Toolmakers, Ltd.

Close