u8.7 802.11b Weaknesses

u8.7 802.11b Weaknesses

1. Initialisation Vector

   • Because it is sent in the clear anyone receiving the wireless signal can see it
   • Methods of generating the IV
     • Ascending counter
     • Ascending and decending counter
     • Pseudo Random IV generator
   • Passive attack on WEP is possible by collecting 2 messages that have been encrypted with the same IV
     • If, for example, the 24-bit IV is generated by an ascending counter, and an access point is transmitting at 11 Mbps, then all IVs will have been used once in roughly 5 hours and the counter will then wrap around and IVs will be used for the second time, and so on every 5 hours.
       • If an attacker were to collect all traffic sent by the access point over a period of more than 5 hours then they would be able to collect two messages that have been encrypted with the same key and same IV
         • Worse still is if the IV is generated by a pseudo-random IV generator. The chance that two randomly selected 24-bit values will be the same is already 50% after only 212 packets (~4000 packets) and that is around 4 seconds in a busy wireless network.

2. WEP

   • A further weakness is created by how some vendors allow users to enter the shared secret keys iinto AP's & Stations
     • User can enter the keys in 2 ways
       • Use a passphrase
         • Secret key is generated from the pass phrase
           • using only alphanumenric characters limits the number of possible keys that can be created
             • Passphrases create only 21 bits of entropy reducing the key strength to 21 bits
               • This can be brute forced
                 • If some encrypted messages are recorded from a wireless network that is using 40-bit WEP, then it is possible to search all 240 keys concatenating each key with the IV attached to each message and decrypting the message ciphertext, checking whether the plaintext is possibly correct
                   • To combat brute force 128 bit keys have been introduced
       • Use hexadecimal values
         • hex values will be secret key

3. Extended service set key management

   • When a number of AP are grouped together in an ESS they must all have the same key
     • AP vendors now provide Key management solutions