Wi-Fi Protected Access
Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) are two security protocols and security certification programs developed by the Wi-Fi Alliance to secure wireless computer networks. The Alliance defined these in response to serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy (WEP).
WPA (sometimes referred to as the draft IEEE 802.11i standard) became available in 2003. The Wi-Fi Alliance intended it as an intermediate measure in anticipation of the availability of the more secure and complex WPA2, which became available in 2004 and is a common shorthand for the full IEEE 802.11i (or IEEE 802.11i-2004) standard.
In January 2018, Wi-Fi Alliance announced the release of WPA3 with several security improvements over WPA2.
- 1 WPA
- 2 Hardware support
- 3 WPA terminology
- 4 EAP extensions under WPA and WPA2 Enterprise
- 5 Security issues
- 6 References
- 7 External links
The Wi-Fi Alliance intended WPA as an intermediate measure to take the place of WEP pending the availability of the full IEEE 802.11i standard. WPA could be implemented through firmware upgrades on wireless network interface cards designed for WEP that began shipping as far back as 1999. However, since the changes required in the wireless access points (APs) were more extensive than those needed on the network cards, most pre-2003 APs could not be upgraded to support WPA.
The WPA protocol implements much of the IEEE 802.11i standard. Specifically, the Temporal Key Integrity Protocol (TKIP) was adopted for WPA. WEP used a 64-bit or 128-bit encryption key that must be manually entered on wireless access points and devices and does not change. TKIP employs a per-packet key, meaning that it dynamically generates a new 128-bit key for each packet and thus prevents the types of attacks that compromised WEP.
WPA also includes a Message Integrity Check, which is designed to prevent an attacker from altering and resending data packets. This replaces the cyclic redundancy check (CRC) that was used by the WEP standard. CRC's main flaw was that it did not provide a sufficiently strong data integrity guarantee for the packets it handled. Well tested message authentication codes existed to solve these problems, but they required too much computation to be used on old network cards. WPA uses a message integrity check algorithm called TKIP to verify the integrity of the packets. TKIP is much stronger than a CRC, but not as strong as the algorithm used in WPA2. Researchers have since discovered a flaw in WPA that relied on older weaknesses in WEP and the limitations of the message integrity code hash function, named Michael, to retrieve the keystream from short packets to use for re-injection and spoofing.
WPA2 replaced WPA. WPA2, which requires testing and certification by the Wi-Fi Alliance, implements the mandatory elements of IEEE 802.11i. In particular, it includes mandatory support for CCMP, an AES-based encryption mode. Certification began in September, 2004; from March 13, 2006, WPA2 certification is mandatory for all new devices to bear the Wi-Fi trademark.
In January 2018, the Wi-Fi Alliance announced WPA3 as a replacement to WPA2. The new standard uses 128-bit encryption in WPA3-Personal mode (192-bit in WPA3-Enterprise) and forward secrecy. The WPA3 standard also replaces the Pre-Shared Key exchange with Simultaneous Authentication of Equals resulting in a more secure initial key exchange in personal mode. The Wi-Fi Alliance also claims that WPA3 will mitigate security issues posed by weak passwords and simplify the process of setting up devices with no display interface.
WPA has been designed specifically to work with wireless hardware produced prior to the introduction of WPA protocol, which provides inadequate security through WEP. Some of these devices support WPA only after applying firmware upgrades, which are not available for some legacy devices.
Wi-Fi devices certified since 2006 support both the WPA and WPA2 security protocols. WPA2 may not work with some older network cards.
Different WPA versions and protection mechanisms can be distinguished based on the target end-user (according to the method of authentication key distribution), and the encryption protocol used.
Target users (authentication key distribution)
- Also referred to as WPA-PSK (pre-shared key) mode, this is designed for home and small office networks and doesn't require an authentication server. Each wireless network device encrypts the network traffic by deriving its 128-bit encryption key from a 256 bit shared key. This key may be entered either as a string of 64 hexadecimal digits, or as a passphrase of 8 to 63 printable ASCII characters. If ASCII characters are used, the 256 bit key is calculated by applying the PBKDF2 key derivation function to the passphrase, using the SSID as the salt and 4096 iterations of HMAC-SHA1. WPA-Personal mode is available with both WPA and WPA2.
- Also referred to as WPA-802.1X mode, and sometimes just WPA (as opposed to WPA-PSK), this is designed for enterprise networks and requires a RADIUS authentication server. This requires a more complicated setup, but provides additional security (e.g. protection against dictionary attacks on short passwords). Various kinds of the Extensible Authentication Protocol (EAP) are used for authentication. WPA-Enterprise mode is available with both WPA and WPA2.
- Wi-Fi Protected Setup (WPS)
- This is an alternative authentication key distribution method intended to simplify and strengthen the process, but which, as widely implemented, creates a major security hole via WPS PIN recovery.
- TKIP (Temporal Key Integrity Protocol)
- The RC4 stream cipher is used with a 128-bit per-packet key, meaning that it dynamically generates a new key for each packet. This is used by WPA.
- CCMP (CTR mode with CBC-MAC Protocol)
- The protocol used by WPA2, based on the Advanced Encryption Standard (AES) cipher along with strong message authenticity and integrity checking is significantly stronger in protection for both privacy and integrity than the RC4-based TKIP that is used by WPA. Among informal names are "AES" and "AES-CCMP". According to the 802.11n specification, this encryption protocol must be used to achieve fast 802.11n high bitrate schemes, though not all implementations[vague] enforce this. Otherwise, the data rate will not exceed 54 MBit/s.
EAP extensions under WPA and WPA2 Enterprise
Originally, only EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) was certified by the Wi-Fi alliance. In April 2010, the Wi-Fi Alliance announced the inclusion of additional EAP types to its WPA- and WPA2- Enterprise certification programs. This was to ensure that WPA-Enterprise certified products can interoperate with one another.
As of 2010[update] the certification program includes the following EAP types:
- EAP-TLS (previously tested)
- EAP-TTLS/MSCHAPv2 (April 2005)
- PEAPv0/EAP-MSCHAPv2 (April 2005)
- PEAPv1/EAP-GTC (April 2005)
- EAP-SIM (April 2005)
- EAP-AKA (April 2009)
- EAP-FAST (April 2009)
802.1X clients and servers developed by specific firms may support other EAP types. This certification is an attempt for popular EAP types to interoperate; their failure to do so as of 2013[update] is one of the major issues preventing rollout of 802.1X on heterogeneous networks.
Brute forcing of simple passwords can be attempted using the Aircrack Suite starting from the four-way authentication handshake exchanged during association or periodic re-authentication.
To further protect against intrusion, the network's SSID should not match any entry in the top 1,000 SSIDs as downloadable rainbow tables have been pre-generated for them and a multitude of common passwords.
WPA3 replaces cryptographic protocols susceptible to off-line analysis with protocols that require interaction with the infrastructure for each guessed password, so that the infrastructure may place temporal limits on the number of guesses.
Lack of forward secrecy
WPA and WPA2 don't provide forward secrecy, meaning that once an adverse person discovers the pre-shared key, they can potentially decrypt all packets encrypted using that PSK transmitted in the future and even past, which could be passively and silently collected by the attacker. This also means an attacker can silently capture and decrypt others' packets if a WPA-protected access point is provided free of charge at a public place, because its password is usually shared to anyone in that place. In other words, WPA only protects from attackers who don't have access to the password. Because of that, it's safer to use Transport Layer Security (TLS) or similar on top of that for the transfer of any sensitive data. However starting from WPA3, this issue has been addressed.
WPA packet spoofing and decryption
Halvorsen and others show how to modify the Beck-Tews attack to allow injection of 3 to 7 packets having a size of at most 596 bytes. The downside is that their attack requires substantially more time to execute: approximately 18 minutes and 25 seconds. In other work Vanhoef and Piessens showed that, when WPA is used to encrypt broadcast packets, their original attack can also be executed. This is an important extension, as substantially more networks use WPA to protect broadcast packets, than to protect unicast packets. The execution time of this attack is on average around 7 minutes, compared to the 14 minutes of the original Vanhoef-Piessens and Beck-Tews attack.
The vulnerabilities of TKIP are significant in that WPA-TKIP had been held to be an extremely safe combination; indeed, WPA-TKIP is still a configuration option upon a wide variety of wireless routing devices provided by many hardware vendors. A survey in 2013 showed that 71% still allow usage of TKIP, and 19% exclusively support TKIP.
WPS PIN recovery
A more serious security flaw was revealed in December 2011 by Stefan Viehböck that affects wireless routers with the Wi-Fi Protected Setup (WPS) feature, regardless of which encryption method they use. Most recent models have this feature and enable it by default. Many consumer Wi-Fi device manufacturers had taken steps to eliminate the potential of weak passphrase choices by promoting alternative methods of automatically generating and distributing strong keys when users add a new wireless adapter or appliance to a network. These methods include pushing buttons on the devices or entering an 8-digit PIN.
The Wi-Fi Alliance standardized these methods as Wi-Fi Protected Setup; however the PIN feature as widely implemented introduced a major new security flaw. The flaw allows a remote attacker to recover the WPS PIN and, with it, the router's WPA/WPA2 password in a few hours. Users have been urged to turn off the WPS feature, although this may not be possible on some router models. Also, the PIN is written on a label on most Wi-Fi routers with WPS, and cannot be changed if compromised.
WPA3 introduces a new alternative for configuration of devices that lack sufficient user interface capabilities by allowing nearby devices to serve as an adequate UI for network provisioning purposes, thus mitigating the need for WPS.
MS-CHAPv2 and lack of AAA server CN validation
Several weaknesses have been found in MS-CHAPv2, some of which severely reduce the complexity of brute-force attacks making them feasible with modern hardware. In 2012 the complexity of breaking MS-CHAPv2 was reduced to that of breaking a single DES key, work by Moxie Marlinspike and Marsh Ray. Moxie advised: "Enterprises who are depending on the mutual authentication properties of MS-CHAPv2 for connection to their WPA2 Radius servers should immediately start migrating to something else."
Tunneled EAP methods using TTLS or PEAP which encrypt the MSCHAPv2 exchange are widely deployed to protect against exploitation of this vulnerability. However, prevalent WPA2 client implementations during the early 2000s were prone to misconfiguration by end users, or in some cases (e.g. Android), lacked any user-accessible way to properly configure validation of AAA server certificate CNs. This extended the relevance of the original weakness in MSCHAPv2 within MiTM attack scenarios. Under stricter WPA2 compliance tests announce alongside WPA3, certified client software will be required to conform to certain behaviors surrounding AAA certificate validation.
Hole196 is a vulnerability in the WPA2 protocol that abuses the shared Group Temporal Key (GTK). It can be used to conduct man-in-the-middle and denial-of-service attacks. However, it assumes that the attacker is already authenticated against Access Point and thus in possession of the GTK.
Predictable Group Temporal Key (GTK)
In 2016 it was shown that the WPA and WPA2 standards contain an insecure expository random number generator (RNG). Researchers showed that, if vendors implement the proposed RNG, an attacker is able to predict the group key (GTK) that is supposed to be randomly generated by the access point (AP). Additionally, they showed that possession of the GTK enables the attacker to inject any traffic into the network, and allowed the attacker to decrypt all internet traffic transmitted over the wireless network. They demonstrated their attack against an Asus RT-AC51U router that uses the MediaTek out-of-tree drivers, which generate the GTK themselves, and showed the GTK can be recovered within two minutes or less. Similarly, they demonstrated the keys generated by Broadcom access daemons running on VxWorks 5 and later can be recovered in four minutes or less, which affects, for example, certain versions of Linksys WRT54G and certain Apple AirPort Extreme models. Vendors can defend against this attack by using a secure RNG. By doing so, Hostapd running on Linux kernels is not vulnerable against this attack and thus routers running typical OpenWrt or LEDE installations do not exhibit this issue.
In October 2017, details of the KRACK (Key Reinstallation Attack) attack on WPA2 were published. The KRACK attack is believed to affect all variants of WPA and WPA2; however, the security implications vary between implementations, depending upon how individual developers interpreted a poorly specified part of the standard. Software patches can resolve the vulnerability but are not available for all devices.
- "Understanding WEP Weaknesses". Wiley Publishing. Retrieved 2010-01-10.
- "Wi-Fi Alliance® introduces security enhancements | Wi-Fi Alliance". www.wi-fi.org. Retrieved 2018-01-09.
- Meyers, Mike (2004). Managing and Troubleshooting Networks. Network+. McGraw Hill. ISBN 978-0-07-225665-9.
- Ciampa, Mark (2006). CWNA Guide to Wireless LANS. Networking. Thomson.
- Huang, Jianyong; Seberry, Jennifer; Susilo, Willy; Bunder, Martin (2005). "Security analysis of Michael: the IEEE 802.11i message integrity code". International Conference on Embedded and Ubiquitous Computing: 423–432. Retrieved 26 February 2017.
- "Battered, but not broken: understanding the WPA crack". Ars Technica. 2008-11-06.
- Jonsson, Jakob. "On the Security of CTR + CBC-MAC" (PDF). NIST. Retrieved 2010-05-15.
- "WPA2 Security Now Mandatory for Wi-Fi CERTIFIED Products". Wi-Fi Alliance. Retrieved 2013-02-28.
- Dawn Kawamoto. "Wi-Fi Alliance Launches WPA2 Enhancements and Debuts WPA3". DARKReading.
- "WPA3 protocol will make public Wi-Fi hotspots a lot more secure". Techspot.
- "Wi-Fi Alliance® introduces Wi-Fi CERTIFIED WPA3™ security | Wi-Fi Alliance". www.wi-fi.org. Retrieved 2018-06-26.
- "The Next Generation of Wi-Fi Security Will Save You From Yourself". WIRED. Retrieved 2018-06-26.
- "Wi-Fi CERTIFIED WPA3™ Program". Retrieved 2018-06-27.
- "Wi-Fi Protected Access White Paper". Wi-Fi Alliance. Archived from the original on 2008-09-14. Retrieved 2008-08-15.
WPA is both forward and backward-compatible and is designed to run on existing Wi-Fi devices as a software download.
- "Wi-Fi Alliance: Glossary". Archived from the original on 2010-03-04. Retrieved 2010-03-01.
- Each character in the passphrase must have an encoding in the range of 32 to 126 (decimal), inclusive. (IEEE Std. 802.11i-2004, Annex H.4.1)
The space character is included in this range.
- van Rantwijk, Joris (2006-12-06). "WPA key calculation — From passphrase to hexadecimal key". Retrieved 2011-12-24.
- "Data rate will not exceed 54 Mbps when WEP or TKIP encryption is configured".
- "Wi-Fi Alliance: Definition of EAP (Extensible Authentication Protocol)". Wi-Fi Alliance Featured Topics.
- "Wi-Fi Alliance expands Wi-Fi Protected Access Certification Program for Enterprise and Government Users". Wi-Fi Alliance Press Release.
- "Wi-Fi Alliance expands Wi-Fi Protected Access Certification Program for Enterprise and Government Users". Wi-Fi Alliance Featured Topics.
- "Wi-Fi CERTIFIED™ expanded to support EAP-AKA and EAP-FAST authentication mechanisms". Wi-Fi Alliance Featured Topics.
- firstname.lastname@example.org. "Radius Server software and AAA RADIUS billing systems - Aradial". Aradial.com. Retrieved 16 October 2017.
- "WPA2 wireless security cracked". ScienceDaily. doi:10.1504/IJICS.2014.059797. Retrieved 2014-04-30.
- "Exposing WPA2 security protocol vulnerabilities". Inderscience.metapress.com. International Journal of Information and Computer Security. 2014-03-13. Archived from the original on 2014-03-22. Retrieved 2014-04-30.
- "Researchers Outline How to Crack WPA2 Security". SecurityWeek.Com. 2014-03-24. Retrieved 2014-04-30.
- "WPA2 wireless security cracked". Phys.org. 2014-03-20. Retrieved 2014-05-16.
- "Exposing WPA2 Paper". InfoSec Community. 2014-05-02. Retrieved 2014-05-16.
- "Wireless Geographic Logging Engine - SSID Stats". WiGLE. Retrieved 2010-11-15.
- "Church of Wifi WPA-PSK Rainbow Tables". The Renderlab. Retrieved 2010-11-15.
- "The Next Generation of Wi-Fi Security Will Save You From Yourself". WIRED. Retrieved 2018-06-26.
- Vanhoef, Mathy; Piessens, Frank (May 2013). "Practical Verification of WPA-TKIP Vulnerabilities" (PDF). Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security. ASIA CCS '13: 427–436. doi:10.1145/2484313.2484368.
- "Practical Attacks against WEP and WPA" (PDF). Retrieved 2010-11-15.
- "Enhanced TKIP Michael Attacks" (PDF). Retrieved 2010-11-15.
- Halvorsen, Finn M.; Haugen, Olav; Eian, Martin; Mjølsnes, Stig F. (September 30, 2009). "An Improved Attack on TKIP". 5838: 120–132. doi:10.1007/978-3-642-04766-4_9.
- Vanhoef, Mathy; Piessens, Frank (December 2014). "Advanced Wi-Fi Attacks Using Commodity Hardware" (PDF). Proceedings of the 30th Annual Computer Security Applications Conference. ACSAC '14: 256–265. doi:10.1145/2664243.2664260.
- Viehbock, Stefan (26 December 2011). "Brute forcing Wi-Fi Protected Setup" (PDF).
- "Vulnerability Note VU#723755 - WiFi Protected Setup (WPS) PIN brute force vulnerability". Kb.cert.org. Retrieved 16 October 2017.
- "Divide and Conquer: Cracking MS-CHAPv2 with a 100% success rate". Moxie Marlinspike. Archived from the original on 2016-03-16. Retrieved 2012-08-03.
- "Is WPA2 Security Broken Due to Defcon MS-CHAPv2 Cracking?".
- "Mojo Networks Scalable Secure Cloud Managed WiFi WPA2 Hole196 Vulnerability". Airtightnetworks.com. Retrieved 16 October 2017.
- Tangent, The Dark. "DEF CON® Hacking Conference - DEF CON 18 Archive". Defcon.org. Retrieved 16 October 2017.
- Vanhoef, Mathy; Piessens, Frank (August 2016). "Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys" (PDF). Proceedings of the 25th USENIX Security Symposium: 673–688.
- "KRACK Attacks: Breaking WPA2". Krackattacks.com. Retrieved 16 October 2017.
- "Severe flaw in WPA2 protocol leaves Wi-Fi traffic open to eavesdropping". Arstechnica.com. Retrieved 16 October 2017.
- Chacos, Brad; Simon, Michael. "KRACK Wi-Fi attack threatens all networks: How to stay safe and what you need to know". PCWorld. Retrieved 2018-02-06.
- Official standards document: "IEEE Std 802.11i-2004" (PDF). IEEE (The Institute of Electrical and Electronics Engineers, Inc.). 23 July 2004. ISBN 0-7381-4074-0.
- Wi-Fi at Curlie
- Wi-Fi Alliance's Interoperability Certificate page
- Weakness in Passphrase Choice in WPA Interface, by Robert Moskowitz. Retrieved March 2, 2004.
- The Evolution of 802.11 Wireless Security, by Kevin Benton, April 18th 2010