Methodology for Wireless Protocol E

A Methodology for Evaluating

Wireless Network Security Protocols

Presented on: December 10, 2004

David Rager and Kandaraj Piamrat

CS386M: Communication Networks - Fall 2004

David Rager CS386MKandaraj Piamrat Fall 2004

Table of Content

1. Introduction 3

2. Explanation of Terms 4

3. Methodology 6a. Authentication capability 7b. Encryption strength 8c. Integrity guarantees 9d. Prevention of attacks 10e. Identity prevention 12f. Ease and cost of implementation 13g. Power consumption 14h. Novel idea 15

4. Analysis of Protocols 16a. WEP 16b. WPA 19c. RSN 21d. VPN 23

5. Conclusion 24

6. References 25

7. Appendix 27

a. Comparison of categorical performance 27b. Main contributors to each protocol’s success 27c. Derivation of points in concrete form 28

2


Introduction

Wireless networks have been deployed everywhere in today’s internet, causing all to think about its security. Unfortunately wireless networks have a lot of properties that attackers can use to mount an attack. These properties are for example, dynamicity (wireless network are mobile so they change the topology more frequently than a wired one), power constraints (mobile nodes are constrained in power consumption by their batteries), and finally agent-based properties (wireless networks usually use agents such as caches and proxies to enhance their performance).

Wireless network security has two wide approaches. The first one can be called “first line of defense” [7], which include prevention mechanisms such as authentication, authorization, and encryption. The second line of defense is the intrusion detection and response approach used to detect the attack or to respond after an attack occurs. In this paper, we consider the first line of defense.

While significant progress has already been made on fixing the problems with the current line of defense, there is no clear metric methodology for evaluating the efficacy of new protocols. We will categorize the different security requirements of a protocol, such as authentication capability, encryption strength, integrity guarantees, protection of identity, and the ease and cost of implementation. After enumerating how we can measure a protocol by these properties, we will analyze WEP, WPA, and the complete 802.11i in terms of these measurements.

3


Explanation of Terms[17]

RC4 is a symmetric stream cipher with an arbitrary key size. It is used in many applications such as WEP, TLS, and TKIP. It is not patented but it is a trade secret of RSA security. There used to also exist an exportable variant of RC4 which utilizes a 40-bit key, which is vulnerable to a brute force attack.

EAP (Extensible Authentication Protocol) [rfc2284] is a general protocol for PPP authentication that supports multiple authentication mechanisms. It provides an infrastructure that enables clients to authenticate via a central authentication server. EAP does not select a specific authentication mechanism at the link control phase but rather postpones this until the authentication phase; this enables the authenticator to request more information before determining the specific authentication mechanism to use.

802.11X is an IEEE standard for EAP encapsulation in wired and wireless network. It defines three roles: the supplicant (user or client requesting authentication), the authentication server (the server providing authentication), and the authenticator (the device which the supplicant requests access to and that requests access from the authentication server - usually the Wireless Access Point).

TKIP (Temporal Key Integrity Protocol) uses an RC4 stream cipher with 128-bit keys for encryption and 64-bit keys for authentication. It has a per-packet key mixing function to de-correlate the public initialization vectors (IV) from weak keys and also has a rekeying mechanism to provide fresh encryption and integrity keys. As a result, it is resistant to cryptographic attacks based on key reuse.

AES (Advanced Encryption Standard) is a symmetric cipher which is faster than asymmetric ciphers, but its requirements for key exchange makes it difficult to use. It also requires more hardware on the network card than exists on current day devices.

ICV (Integrity Check Value) is a checksum capable of detecting modification of an information system.

MIC (Message Integrity Check) is part of the 802.11i standard. It is an additional 8 byte field placed between the data portion of an 802.11 frame and the 4 byte ICV (Integrity Check Value). In fact, MIC is very similar to the older ICV, but instead of guaranteeing only the packet payload, it also protects the header. The algorithm that implements MIC is known as Michael, and it also implements a frame counter, which discourages replay attacks.

CCMP (Counter mode with Cipher block Chaining Message authentication code Protocol) is the integrity mechanism in the 802.11i standard. It is based on the CCM mode of the AES encryption algorithm. It uses 128-bit keys, with a 48-bit initialization vector for replay avoidance. It has two components. The first is Counter Mode (CM) which provides data privacy, and the second is Cipher Block Chaining Message Authentication Code (CBC-MAC) which provides data integrity and authentication. CCMP is mandatory for anyone implementing RSN

4


(Robust Secure Network). CCMP has some disadvantage since it cannot be used with a machine that does not have enough CPU power.

RADIUS (Remote Authentication Dial In User Service) is a protocol for remote user authentication and accountability. It enables centralized management of authentication data, such as usernames and passwords. It utilizes the MD5 algorithm for secure password hashing. Communications between the client and server are authenticated and encrypted using a shared secret which is not transmitted over the network. The RADIUS server is an excellent choice for keeping track of every user’s access, because it is a centralized authentication server. The disadvantage is that since everything is in the RADIUS server, if it is compromised, the attacker obtains everything.

IV (Initialization Vector) is a block of bits that is combined with the first block of data in any of several modes of a block cipher. In some cryptosystems, it is random and is sent with the cipher text.

Handshaking in data communication is a sequence of events governed by hardware or software, requiring mutual agreement of the state of the operational mode before information exchange. An n-way handshake uses n messages to establish the connection.

Per-Packet Key Mixing is a function used in a per-packet encryption key. It takes the base key, transmitter MAC address, and packet sequence number as inputs and outputs a new per-packet WEP key.

5


Methodology

In this paper, we considered four main approaches which are cited in chronological order as the following: WEP, WPA, 802.11i / RSN, and VPN. The first three approaches are derived chronologically from each other. This means that the more recent approach tries to solve the problem found in the earlier ones. In this paper we look through all the approaches to see techniques that they use for security and then evaluate these techniques separately from the approaches. At the end of the evaluation we will be able to measure the performance of each approach depending on the purpose of the network.

In order to evaluate each approach, we need to define metrics that we are going to use. Therefore we decide to use the following metrics:

6


Authentication Capability

When a user wants to use the network, the network devices decide how much authentication is required to allow a new user on the network. A protocol can be trivially setup to allow anyone anonymously on the network, protecting the identity of a client. A protocol can perform authentication via challenge response messages, requiring knowledge of a group key. A protocol may require the hardware of the user to meet certain specifications (like a MAC address). Finally, a protocol may authenticate a user based upon his/her own credentials, perhaps through a password verified via an internal server.

The authentication protocol must not be prone to man in the middle attacks and all exchanged passwords must be securely transmitted. Also, in the event that an intruder can capture an authentication server, the greater the redundancy between servers and synchronized decisions between them, the better. Creating a Byzantine agreement protocol is complex computationally and expensive in terms of network efficiency, so points should be removed under ease of use via number of messages exchanged.

It can be seen that in order to be efficient in authentication, we should consider several parameters. Table 1 explains what should be considered:

Consideration 0(bad) 1(fair) 2(good)Type of authentication Key with challenge

responseKey with challenge response and MAC

address

Credentials based

Number of authentication servers

One Three (# faults permitted) * 3 + 1

Use of new authentication mechanisms

None - Use of EAP (802.11X)[17]

Known MITM attacks One or more - None

Table 1: Authentication capability

7


Encryption Strength

A good protocol must choose an encryption scheme that is secure under a probabilistic polynomial time model. Additionally, the protocol must apply the encryption scheme in a way that does not open a good encryption scheme to vulnerability. A good protocol should have a key management mechanism so the user will not have to worry about the manually generating and installing new keys.

In order to have that good protocol, we consider the different parameters below:

Consideration 0(bad) 1(fair) 2(good)Key type Static key - Dynamic key

Cipher key type RC4 - AESCipher key length 40 or 104 bit

encryption128 bit encryption 128 bit encryption +

64 bit authentication

Key lifetime 24-bit IV 48-bit IV 48-bit IVTime used to crack Few hours Few days CenturiesEncrypted packet needed to crack

Few millions - Few billions

Can be recovered by cryptanalysis

Yes - No

Key management used

None Static EAP

Table 2: Encryption Strength

8


Integrity Guarantees

Giving a recipient a means to check a message’s integrity is a well known step for preventing message tampering. A good integrity scheme will compute a hash involving each bit in the message. This hash will be a one-way hash, such that the message can not be reverse engineered and changing a bit in the message should result in a large change in the hash value.

If a hash function that does not meet these requirements is used, then the integrity value should be transmitted under encryption of a fresh or well-protected key. Therefore, it may be good to use a public/private key scheme to communicate the integrity value securely.

In order to ensure integrity, we should guarantee two things: integrity of the message header and integrity of the data itself. For example, it is known that the use of the CRC checksum called Integrity check value is not secure and the packet can be intercepted. So a good protocol will not use this mechanism. On the other hand, CCM is a long term solution and it should be deployed when possible.

Consideration 0(bad) 1(fair) 2(good)Integrity of message

headerNone Michael CCM[4]

Integrity of the data CRC-32 Michael CCM

Table 3: Integrity Guarantees

9


Prevention of Attacks

When a key is discovered by attackers, it is important that the discovered key is rotated out soon. Therefore, a protocol that provides a fresh key frequently is more secure than a protocol that uses the same key until user intervention. Additionally, the next key derived should be independent of all previous keys, satisfying a requirement called “forward secrecy.”

Replay attacksA replay attack involves two users communicating and a third one later using one of the messages communicated to gain some advantage he would not have otherwise. A good example is supposing Alice and Bob are communicating, and Eve is listening. Alice needs to authenticate herself to Bob, so Alice sends Bob an encrypted version of her password. Later, Eve can pose as Alice, because when Bob asks for Alice’s password, all Eve needs to do is replay the message she captured earlier. Bob will accept that authentication and will begin communicating with Eve assuming that Eve is actually Alice. Thus Eve will have access to all the same information that Alice does, perhaps even the ability to change her password.

Once included, prevention of a replay attack is actually quite simple. Bob will send Alice a fresh nonce, a newly generated random number, to act as a session identifier. Alice appends this nonce to the password, and then encrypts. Since each message to encrypt is now different, because each session will have a different nonce, the encrypted version of the password can not be replayed. If Eve tries to act as Alice, she will receive a new nonce from the server, and since Eve does not know the encryption key, she will be unable to create a new password message.

It is interesting to note that the nonce is transmitted in the clear. So long as Bob sends a fresh nonce whenever a new session or IP address is encountered, the actor posing as Alice will always have to know the key to fake an encryption.

We say a protocol is secure from a replay attack if it provides a sense of freshness for each packet, which would keep an intruder from replaying that packet. The use of an initialization vector is a start towards this, but the space must be large enough such that collisions are rare.

DoS

Denial of Service (DoS) takes on many meanings. At its core, DoS attacks involve preventing a client from receiving a service from the network that it would be able to receive under more friendly conditions.

In wireless security, DoS attacks have various forms. As briefly explained in the survey paper and more completely explained in Bellardo and Savage’s work, it is possible to deny a client service to an access point by sending a small 30 messages per second on the link layer. It is also possible to deny wireless networks service by jamming the relevant frequencies, an exploitation of the physical layer. It is also possible for another client to pose as a wireless station, confusing other wireless clients and effectively denying them service. This exploit involves acting as a

10


DHCP server and Internet gateway and is hence a layer three attack. A good protocol is robust from attack on all layers used.

One well-known method for preventing some DoS attacks is to use a “cookie.” A cookie usually contains a hash under a personal key of the source address of the initiator, any session identifiers, and something that the responder knows and can remember across many sessions without setting up state for a specific session. A cookie is usually involved in at least a four-way handshake and works like this:

1. Initiator sends a request to the responder to have a session2. Responder sends back an acknowledgement and a cookie3. If the initiator sent with the correct source IP address in step one, he will receive part two

and can reply with the cookie and setup the session4. If the responder receives the correct cookie, he will also setup the session.

So, the cookie works, because the responder will not initiate state until he has verified the source address of the initiator. Since many DoS attacks rely upon spoofing a source address, this is a reasonably effective method for prevention.

Consideration 0(bad) 1(fair) 2(good)Replay attack

preventionNone - IV sequence , Per-

packet key mixingDoS cookie No - Yes

Number of known attacks prevented

None Some of them All of them

Table 4: Prevention of attacks

11


Identity Protection

A good protocol is one that only reveals identity to the intended parties. Preservation of identity keeps attackers from narrowing their search for a given user’s information. At some point, identity or group identity must be communicated if authentication is to make progress. A protocol which reveals identities in plain-text has the worst identity protection, while a protocol that reveals identity under a strong form of encryption with a fresh key has the best type of identity protection.

It is also better to use a basic form of authentication like source IP address validation before revealing identity.

Consideration 0(bad) 1(fair) 2(good)Group identity

revealed toEntire network All parties Specific parties

Specific identity revealed to

Entire network All parties Specific parties

Table 5: Identity protection

12


Ease and Cost of Implementation

Since the computational costs of setting up an anonymous connection are close to none, we will use this as the highest standard. The “ease” of implementation is a subjective measure, which requires some knowledge of technology already in existence. One concrete measure of a protocol could be the number of gates it would require in a client’s hardware device. Another concrete measure could be the number of lines of code required to implement it. The complexity of the protocol can also be measured by the number of actors involved and the number of messages exchanged.

The network utilization efficiency can be measured by the number of handshakes and parties involved in establishing a user’s identity. In other words, if a protocol requires four parties to authenticate a user instead of three but establishes identity to the same degree of security the protocol requiring four parties is less efficient.

A new protocol should be relatively easy to deploy, in that it does not require a complete overhaul of a network to function. We currently do not know of a protocol that can not be implemented completely incrementally, but we can imagine that such a protocol could be created.

Consideration 0(bad) 1(fair) 2(good)Computation cost High Medium Low

Incremental installation

No - Yes

Number of messages exchanged

300 30 3

Number of actors involved

Many actors - Few actors

Packet key Mixing function Concatenated No needAdditional server

hardwareYes - No

Additional network infrastructure

Yes - No

Number of gates in client device

High - Low

Lines of Code High - Low

Table 6: Ease and cost of implementation

13


Power Consumption

Most devices that use wireless connections run from a battery-powered power source. As a result, it is only fair to include power consumption in our evaluation of wireless protocols. Power consumption is best measured in a relative manner between protocols. For example, a protocol which uses AES will use more power than one that uses RC4.

Additionally, when a client receives attack-like behavior, it would be good for a protocol to specify a means to detect the attack and conserve power. This is especially important for networks that are seldom recharged, like sensor networks. A wireless protocol evaluation methodology would be incomplete without considering power. It should be noted that implementing AES in hardware instead of running it from ROM software cuts the power cost significantly [5].

Consideration 0(bad) 1(fair) 2(good)Clients use low power No - Yes

Client can detect attacks and enter low-

power mode

No - Yes

Table 7: Power consumption

14


Novel Ideas

In this section we aim to include an idea that is currently unincorporated into wireless network security protocols. Additionally, we want to leave some room for rewarding ideas no one has thought of yet. This flexibility will be important for measuring new protocols.

A protocol that could tell whether a client is inside a given physical boundary could keep intruders external to a corporation at bay. Perhaps we could accomplish this by some form of signal triangulation, where a client registers with different wireless access points, and the strength of his signal is measured at each access point. Each access point would experience different levels of signal interference, as the signal would travel around monitors, but perhaps this can be overcome by having more than three observation points and some tricky mathematics. Regardless, the ability to tell the physical location of a wireless client could be useful.

Consideration 0(bad) 1(fair) 2(good)Determines physical

locationNo - Yes

15


Analysis of Protocols

WEP (Wired Equivalent Privacy)

WEP is an encryption algorithm that is a part of the 802.11b standards. It was designed to be as secure as a wired LAN. But it seems that WEP has a lot of flaws and is prone to many attacks . Some examples are: passive attacks to decrypt traffic based on statistical analysis, active attacks to inject new traffic from unauthorized mobile stations based on known plain text, active attacks to decrypt traffic based on tricking the access point, and a dictionary-building attack that after analysis of about a day’s worth of traffic allows real time automated decryption of traffic.

Summary of techniques used in WEP

Challenge response authentication mechanism – Shared Key Authentication 2 party, 3 way handshake RC4 Symmetric key cipher encryption algorithm Single static preshared 40/104 bit key Initialization vector for creating freshness of encryption key Self-synchronizing [15]

Packet integrity check

Analysis

WEP will be the weakest of the protocols we analyze, because it is the oldest and has the largest number of known attacks. It earns an average score of 30.6%.

Authentication: (0/8)

WEP has a keyed challenge response mechanism for authentication, where the client requests a challenge message to encrypt from the server, and if the client sends back a valid encryption of that message under the shared key, that client is considered authenticated. Additionally, WEP only uses one “server”, the access point itself, to authenticate a client. None of the newer EAP-based authentication mechanisms are used in WEP, and there are known MITM attacks, where a client can pose as a server. These problems earn WEP a score of 0 for authentication.

Encryption Strength: (0/16)

WEP uses a static key shared amongst all users for a given wireless network identifier. While a server can rotate the key chosen, there are still only three other choices. WEP uses the well-known and accepted cipher RC4 to encrypt data in linear time. Unfortunately, WEP uses this solid encryption scheme in a way that makes RC4 vulnerable to attack and thus RC4 is not a benefit, but a liability. The 40 bit version of WEP is relatively weak when compared to the 104 bit version and other 128 bit keys in other protocols. The 40 bit version existed to meet exportation laws. Since those have been repealed, a key so short seems only applicable to personal use where security is not an issue. If we were to consider personal finances private,

16


however, the 40 bit key is not enough. Throughout WEP’s lifetime, many have discovered its 24 bit initialization vector (IV) to be a weakness. With a space of 224 and the IV being sent in the clear, collisions occur too often to be of statistically secure significance. These collisions, combined with a short key on a high-traffic network can yield a key that takes only a few hours to crack. This cracking can be done with as little as four million packets. Finally, the ability to automatically revoke a key from the network via a management interface is not built-in to WEP. Failing all of these conditions, WEP earns a score of 0 when it comes to encryption strength.

Integrity Guarantees: (0/4)

WEP uses a simple checksum to guarantee the integrity of the data itself and does nothing to guarantee the header, so it earns a score of 0.

Prevention of Attacks: (0/6)

There are many attacks for WEP. As previously mentioned, WEP has attacks on all the network layers it uses. For details of other types of attacks please see Your Wireless Network Has No Clothes and Intercepting Mobile Communications: The Insecurity of 802.11. As simple as WEP is, it still has a DoS weakness in its normal operation. The basic challenge response authentication mechanism requires the server to remember what challenge message it sent the client. Otherwise the client could lie about what challenge message it received and commit a replay attack, reusing a previous challenge response dialogue it witnessed earlier. WEP could have avoided this DoS by giving the client a signature of the challenge message under its own private key to return along with a copy of the challenge message and the clients encryption. However, WEP specifies no use of a cookie. Finally, while WEP has a notion of fresh encryption for each packet by using IVs, it uses the small space of 2^24. So as WEP is, it receives a score of 0 for prevention of attacks.

Identity Protection: (4/4)

WEP performs quite well when it comes to identity protection. The only identity revealed is its association with a group that knows the key to the wireless station.

Ease and Cost of Implementation: (17/18)

WEP consists of two simple security mechanisms: an authentication phase and a communication under encryption phase. Both of these phases are remarkably simple. Authentication occurs with a simple challenge response exchange. Encryption occurs with an XOR which is linear in time relative to the length of the message. The computational cost of doing an XOR is quite low when compared to other encryption standards like AES. The number of actors needed to coordinate authentication and encryption are just the client and access point. Since WEP is already a mainstream product, products that support WEP versus no encryption are equally cheap. In sum, WEP is a great protocol when we examine just the cost in hardware, so we award it a (17/18) in this area.

17


Power Consumption: (2/4)

In general, WEP does not consume much power. This is mainly due to the computational simplicity of the encryption scheme, but it can also be credited to the sleep mode standard with most implementations. Since WEP does not have a method for detecting attacks and automatically sleeping for awhile, it receives only a score of (2/4).

Novel Ideas: (0/2)

WEP neither provides a way to determine physical location nor provides something creative of its own. So, while WEP was the first approach at a wireless security protocol, something novel in and of itself, that novelty does not translate to measurable merits. As a result, WEP receives a score of 0 in this area.

18


WPA (Wi-Fi Protected Access)

WPA is basically a corrected version of WEP with additional mechanisms to improve security and performance. There are two modes of WPA (Enterprise mode and Pre-Shared Key mode). Since the pre-shared key mode is quite similar to WEP, we will consider the enterprise mode which is more secure and has additional mechanisms. Note that the enterprise mode is not used in a home wireless network because it requires a RADIUS server which is too expensive for the home user.

Summary of techniques used in WPA

3 party, multi way handshake RC4 (note that some vendors also implement WPA2 which uses AES instead of RC4) 128 bit keys Temporal Key Integrity Protocol (TKIP)– fresh key 802.1X dynamically assigns and distributes keys per session/user/packet, it is the

standard for Extensible Authentication Protocol (EAP) Packet Integrity Check (MIC) that protect the header as well as the payload

Analysis of WPA

Given the mistakes of WEP to learn from, WPA is a much more solid protocol and earns an overall score of 41.5%.

Authentication Capability: (6/8)

WPA employs a complex authentication mechanism. WPA authentication involves four parties: the client, the access point, a RADIUS authentication server, and a certificate authority. WPA allows four to five main variants of an Extensible Authentication Protocol (EAP). Included in this list are LEAP, EAP-TLS, EAP-TTLS, and PEAP. The differences between each of these protocols can be found in the IBM presentation Securing a Wireless LAN. In short, they always involve server certificates for verifying server identity and helping derive the key. The client can be authenticated using legacy methods like CHAP or more modern methods like EAP-MD5. There are no known MITM attacks for WPA, and while it is credentials based system, it uses only one authentication server, so we give it a score of (6/8).


The encryption scheme employed by WPA is still RC4. However, WPA uses RC4 in a way that allows it to maintain its strength. For starters, the initialization vector is twice as long at 48 bits, and the key length is a standard 128 bits. Additionally, WPA has a built-in mechanism for providing fresh keys to clients. Every time a client authenticates, it and the server derive a new pair-wise key. While WEP had a later modification to allow a rotation of keys, called TKIP, WPA signifies the completion of this idea, in that it provides a fresh key every time. The larger space of IVs (2^48) ensures that there will be less collisions for the time that one key is used, and

19


that trillions, not millions of packets must be collected before cryptanalysis can be done. One potential future vulnerability could be in how a server and client compute a fresh key. Each key should be perfectly independent of the previously derived key. WPA still uses the older encryption scheme RC4 to maintain backwards compatibility with older hardware. A stronger encryption scheme is still desired, so we give WPA a score of (14/16).


WPA uses the integrity method called Michael (MIC). MIC is described under Explanation of Terms. Our methodology could not be clearer, in that MIC is a technique more complex than a checksum, but still simpler than other signature methods. So, it earns a score of (2/4).


WPA uses per packet 48-bit IVs that provide good prevention of replay attacks. There is no cookie, so WPA is still vulnerable to DoS, and now there are more parties to deny service – the access point and the RADIUS server. There are no known attacks on WPA, but this may change with time. Due to the lack of a cookie, we give WPA a (4/6).


WPA involves the client specifically answering the question “Who are you?”[12]. There is no plainer violation of identity protection than answering this question on the open air waves. WPA receives a score of (0/4).


WPA is significantly more difficult to implement than WEP. The addition of two other parties, the RADIUS server and the certificate authority, require many more lines of code to implement the protocol correctly. While it is significantly more complex, the basic encryption scheme is still relatively simple, so WPA can still run on legacy hardware. Because of this, we give it a score of (7/18).


In general, WPA does not consume much power. This is mainly due to the computational simplicity of the encryption scheme, but it can also be credited to the sleep mode standard with most implementations. Since WPA does not have a method for detecting attack and automatically sleeping for awhile, it receives only a score of 1/4 exactly like WEP.

Novel Ideas: (0/2)

Much like WEP, WPA neither addresses our own idea of determining physical location nor creates something completely new that our methodology does not cover. As a result, it also earns a score of (0/2).

20


802.11i / Robust Secure Network (RSN)

While WPA implements the improvements possible on legacy hardware, RSN represents everything that we wanted to place in WPA but could not due to hardware restrictions. As a result, we will see a couple key differences between WPA and RSN. To make reading easier, those which are the same will be marked with a reference to the WPA explanation. RSN’s overall score is 51.0%

Summary of techniques used in 802.11i

EAP 3 party, multi way handshake Advanced Encryption Standard Symmetric cipher 128 bit keys Requires more computationally powerful hardware Packet Integrity Check (Counter Mode Encryption)

Analysis of 802.11i / RSN

RSN’s average score is:

Authentication Capability: (6/8)

See WPA.


AES provides a stronger encryption scheme over WEP’s RC4. AES provides solid strength, so we give it a score of (15/16).


With more expensive hardware, AES can use the integrity method called CCM. Put shortly, CCM guarantees more than MIC, so it is rewarded with a score of (4/4).


See WPA.


See WPA.

21



It is quite similar to WPA, except it is even more difficult to implement and upgrade since it requires new client hardware. This difficulty warrants RSN a score of (4/18).


When AES is implemented in hardware, its power consumption is drastically less than when in software. As a result, we assume that in the long run power consumption of AES will be acceptable. Much like WPA, since RSN does not have a method for detecting attack and automatically sleeping for awhile, it receives only a score of (2/4), exactly like WEP and WPA.

Novel Ideas: (0/2)

Much like WEP and WPA, RSN neither addresses our own idea of determining physical location nor creates something completely new that our methodology does not cover. As a result, it also earns a score of (0/2).

22


VPN

Virtual Private Network is a network constructed by using public wires to privately connect nodes. For example there are a number of systems that enable you to create networks using the Internet as the medium for data communication. These systems use encryption and other security mechanisms to ensure that only authorized users can access the network and that the data cannot be decrypted upon interception. The mechanism used in VPN differs from the other approach by “Tunneling,” which is the process of placing an entire packet within another packet and sending it over a network. The protocol of the outer packet is understood by the network and both end points, called tunnel interfaces for where the packet enters and exits the network. To implement tunneling, we require 3 additional protocols (Carrier protocol, Encapsulating protocol, and Passenger protocol)

VPN uses several methods for keeping the connection and data secure. Some mechanisms are firewalls, encryption, IPSec, and the AAA server:

A firewall provides a strong barrier between your private network and the Internet. You can set firewalls to restrict the number of open ports, what types of packets are forwarded and which protocols are allowed.

IPSec (Internet Protocol Security Protocol) provides enhanced security features such as better encryption algorithms and more comprehensive authentication. IPSec has two encryption modes: tunnel and transport. Tunnel mode encrypts the header and the payload of each packet while transport mode only encrypts the payload. Only systems that are IPSec compliant can take advantage of this protocol. Also, all devices must use a common key and the firewalls of each network must have very similar security policies set up. IPSec can encrypt data between various devices, such as: router to router, firewall to router, PC to router, and PC to server

AAA (Authentication, Authorization and Accounting) servers are used for more secure access in a remote-access VPN environment. When a request to establish a session comes in from a dial-up client, the request is proxied to the AAA server. AAA then checks the following: who you are (authentication), what you are allowed to do (authorization) and what you actually do (accounting).

VPN seems to be powerful but VPN is also expensive. First of all, tunneling requires additional protocols to manage it (Carrier protocol, Encapsulating protocol, and Passenger protocol). Moreover there are other requirements for administrating the VPN - the administrator must know how much the VPN will be used and what type of data will be traveling through it.

Analysis of VPN

VPN is a type of overlay for WEP. Since it is not in and of itself a wireless protocol, it is not directly comparable. We can dream up many overlays for any of the technologies discussed, but we are focusing on securing the lowest layer possible. We include discussion of it above as an example of one solution to the WEP problem that industry has adopted but stop short of measuring it, because it is not the lowest layer of security.

23

http://computer.howstuffworks.com/question525.htm

http://computer.howstuffworks.com/firewall.htm


Conclusion

We have defined a methodology for evaluating wireless network security protocols. This methodology encompasses the following characteristics:

Authentication Capability Encryption Strength Integrity Guarantees Prevention of Attacks Identity Protection Ease and Cost of Implementation Power Consumption Novel Ideas

We then analyzed WEP, WPA, and 802.11i / RSN according to these metrics. As expected, WEP performed the worst according to our measurements, while WPA and 802.11i / RSN performed about the same – primarily because 802.11i / RSN requires better hardware support.

This methodology helps highlight some of the desires for different types of networks. For a sensor network, where nodes are often left unconnected to power for a long duration, a high score in power consumption is desirable. The typical corporation probably wants the highest overall score and is probably willing to sacrifice some power and computation to obtain it.

24


References

[1] Arbaugh, William A., Shankar, Narendar and Wan, Justin Y.C. Your 802.11 Wireless Network Has No Clothes. March 30, 2001.http://www.cs.umd.edu/~waa/wireless.pdf

[2] Bellardo, John and Savage, Stefan. 802.11 Denial-of-Service Attacks: Real Vulnerabilites and Practical Solutions. USENIX Security Symposium. 2003.http://www.usenix.org/events/sec03/tech/bellardo.html

[3] Borisov, Nikita, Goldberg, Ian, and Wagner, David. Intercepting Mobile Communications: The Insecurity of 802.11. CiteSeer. 2001.http://www.isaac.cs.berkeley.edu/isaac/mobicom.pdf

[4] Cam-Winget, Nancy, Housley, Russ, Wagner, David, and Walker Jesse. Security Flaws in 802.11 Data Link Protocols. Communications of the ACM Vol. 46, No. 5. May 2003.

[5] Callaway, Ed. Secure Low-Power Operation of Wireless Sensor Networks. Sensormag.com. January 2004. http://www.sensorsmag.com/articles/0104/22/main.shtml

[6] Cohen, Alan and O’hara, Bob. 802.11i Shores Up Wireless Security. Network World. July 26, 2003. http://www.nwfusion.com/news/tech/2003/0526techupdate.html

[7] Faria, D.B. and Cheriton, D.R.. DoS and Authentication in Wireless Public Access Networks. International Conference on Mobile Computing and Networking Proceedings of the ACM Workshop on Wireless Security Atlanta, GA, USA. 2002.

[8] Gast, Matthew. Wireless LAN Security Protocols. O’Reilly Emerging Technology Conference. April 2003.http://conferences.oreillynet.com/presentations/et2003/gast_final.pdf

[9] Geier, Jim. Beware of ARP Attacks. Wi-Fi Planet. November 24, 2003.http://www.wi-fiplanet.com/tutorials/article.php/3112991

[10] Glendinning, Duncan. 802.11 Security. Intel Developer Forum. September 17, 2003.http://www.intel.com/idf/us/fall2003/presentations/F03USMOBS169_OS.pdf

[11] Klaus, Christopher W. WLAN FAQ. Internet Security Systems. October 6, 2002.http://www.iss.net/wireless/WLAN_FAQ.php

[12] Knapp, Laura Jeanne and Hadley, Tom. Securing a Wireless LAN. IBM. http://www.lauraknapp.com/images/Wiresec.pdf

25

http://www.lauraknapp.com/images/Wiresec.pdf

http://www.iss.net/wireless/WLAN_FAQ.php

http://www.intel.com/idf/us/fall2003/presentations/F03USMOBS169_OS.pdf

http://www.wi-fiplanet.com/tutorials/article.php/3112991

http://conferences.oreillynet.com/presentations/et2003/gast_final.pdf

http://www.nwfusion.com/news/tech/2003/0526techupdate.html

http://www.sensorsmag.com/articles/0104/22/main.shtml

http://www.isaac.cs.berkeley.edu/isaac/mobicom.pdf

http://www.usenix.org/events/sec03/tech/bellardo.html

http://www.cs.umd.edu/~waa/wireless.pdf


[13] Microsoft. Overview of the WPA Wireless Security Update in Windows XP. Microsoft Knowledge Base. September 23, 2004.http://support.microsoft.com/?kbid=815485

[14] Mistano, Marco. Wireless LAN Security. Cicsco. 2003.http://www.clusit.it/evento_ord_ing/misi_wlan.pdf

[15] SMU. Modern Stream Ciphers. Retrieved on December 10, 2004. http://engr.smu.edu/~nair/courses/7349/stream.ppt#16

[16] Snyder, Joel and Thayer, Rodney. 802.11i: The Next Big Thing. Network World Fusion. October 10, 2004.http://www.nwfusion.com/reviews/2004/1004wireless80211i.html

[17] Tech-faq. The Tech FAQ – Wireless Networks. Tech-FAQ.com. December 10, 2004.http://www.tech-faq.com/wireless-networks/wireless-networks.shtml

[18] Welch, Donald J and Lathrop Scott D. A Survey of 802.11a Wireless Security Threats and Security Mechanisms, Information Technology and Operation Center, 2003http://www.itoc.usma.edu/Documents/ITOC_TR-2003-101_(G6).pdf

[19] Wikapedia. Replay Attack. Wikapedia.com. December 10, 2004.http://en.wikipedia.org/wiki/Replay_attack

26

http://en.wikipedia.org/wiki/Replay_attack

http://www.itoc.usma.edu/Documents/ITOC_TR-2003-101_(G6).pdf

http://www.tech-faq.com/wireless-networks/wireless-networks.shtml

http://www.nwfusion.com/reviews/2004/1004wireless80211i.html

http://engr.smu.edu/~nair/courses/7349/stream.ppt#16

http://www.clusit.it/evento_ord_ing/misi_wlan.pdf

http://support.microsoft.com/?kbid=815485


Appendix

Comparison of Categorical Performance

0% 20% 40% 60% 80% 100%


Encryption Strength



Identity Protection

Ease and Cost of Implementation

Power Consumption

Novel Ideas

Per

form

ance

Cat

ego

ry

% of Points

WEP

WPA

RSN

Main Contributors to Each Protocol's Success

WEP WPA RSN

Protocol

% o

f P

oin

ts

Novel Ideas

Power Consumption

Ease and Cost ofImplementation

Identity Protection



Encryption Strength


27


The color red means that it was chosen for scoring that particular characteristic.

28


29


30


31


32


33


34


35


36