Subject: [NEXTEL-1] Wireless News: Key to Wi-Fi Security

From: Marcel <[email-masked]>
Date: Mon, 03 Feb 2003 00:01:17 -0500

http://www.wirelessnewsfactor.com/perl/story/20632.html

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ 

Explore:

NewsFactor Sites by Topic
Top Tech News
E-Business News
Wireless Industry News
Tech News Links
CRM Industry News
CRM Buyer Magazine (NEW)
Tech Opinions
Tech Innovation
Sci-Tech
Linux News Links
Free Newsfeeds
** Free Newsletters
-------------------------
NewsFactor Sites by Name:
-------------------------
NewsFactor.com
E-Commerce Times
Wireless NewsFactor
TechNewsWorld
NewsFactor Sci-Tech
CRM Daily
CRM Buyer Magazine
osOpinion
TechExtreme
Linux Insider
Free Newsfeeds
** Free Newsletters

Front Page

Archives

Mobile Devices

Networking

3G Wireless

Big Deals

Mobile Media

Wireless Web

Satellite

M-Commerce

Health & Safety

Stock Index

Key to Wi-Fi Security

Send this Article

Print this Article

Talkback

Related Stories

By Glenn Fleishman & Ephraim Schwartz

January 31, 2003

As we survey the road ahead, it's clear that the arrival of WPA and eventually 802.11i will reduce the administrative burden of WLANs, integrating them with existing authentication mechanisms and making the security issue disappear.

NewsFactor's CIO Today Magazine: Designed to provide I.T. executives with straight-forward answers to the questions they regard as most crucial to making enterprise-level purchasing decisions. Each information-packed issue explores a wide variety of enterprise systems including CRM, Data Storage, Network Security, and much, much more. Click here for FREE subscription.

Conventional wisdom says wireless LAN access to an enterprise adds enormous risk because the broken security model at the heart of Wi-Fi networking allows crackers to break encryption , snoop traffic, insert packets, and associate at will. WLAN access points must be outside the firewall, with VPN connections tunneling through. No exceptions.

Enter the Wi-Fi Alliance, with members that include Microsoft (Nasdaq: MSFT) , Intel (Nasdaq: INTC) , Cisco (Nasdaq: CSCO) and Apple (Nasdaq: AAPL) . Seeking to quell consumer and enterprise concerns about Wi-Fi security holes, the group has essentially lifted the construction engineer's drawings for the work-in-progress IEEE 802.11i security draft and started to pour and smooth the macadam that leads to the golden city on the hill: full 802.11i completion and ratification. This ad hoc engineering project comes with member approval; the move isn't as radical as it seems.

The alliance's new WPA (Wi-Fi protected access) standard uses most of the current 802.11i draft to repair problems in WEP (wired equivalent privacy), the first line of defense for Wi-Fi networks. WEP's goal was to encrypt packets in transit at the data link layer to deter unauthorized network access.

ADVERTISEMENT

WEP failed in its attempt, however, through several cryptographic flaws that resulted in rapid key reuse. These flaws leave the link layer unprotected by Wi-Fi, and thus banished it outside the firewall where protection is provided at higher network layers by VPN, SSH, or other tunneled encryption methods.

WPA solves the problem by abandoning WEP in favor of 802.11i's vastly improved TKIP (temporal key integrity protocol). WPA ensures that TKIP keys vary for each packet through key mixing. WPA also increases part of the keyspace and adds encrypted packet integrity to reject inserted packets. Current Wi-Fi puts weak integrity outside the encrypted payload.

WPA includes full support for server-based authentication using the 802.1x protocol and EAP (extensible authentication protocol), both part of the interim 802.11i draft.

Although EAP lacks a built-in encryption method -- it's merely a generic messaging method -- three overlays that embed EAP inside an encrypted tunnel have emerged to solve different parts of the problem.

An early version, EAP-TLS (transport layer security), required a client-side public-key certificate to be preinstalled before the first wireless session. Although this was the method that Microsoft uses for its campuswide WLAN, EAPTLS is complicated because an enterprise must establish a PKI.

Instead, vendors are focusing on two methods: EAP-TTLS (tunneled TLS) and PEAP (protected EAP), both of which build a tunnel within a tunnel. The outer tunnel is entirely anonymous, allowing a second tunneled session to begin inside it, which itself encapsulates EAP or other protocols. This approach avoids client certificates but still allows for them.

Microsoft and Cisco have backed PEAP. Although virtually identical in principle to EAPTTLS, PEAP handles only EAP and MS-CHAP V2. Microsoft has offered PEAP clients for Windows XP and 2000 for free and plans a full Win32 rollout for Windows 98, NT 4, and Me.

Neither company representatives nor industry observers can explain the necessity for both EAPTTLS and PEAP, the main difference between the two being the latter's lack of legacy authentication support. It's easy to assume that Microsoft and Cisco's agenda was to push enterprises to upgrade to newer authentication servers, but PEAP could wind up as widely available as EAP-TTLS.

Both EAP-TTLS and PEAP are passing through the IETF (Internet engineering task force) process toward hopeful reconciliation or at least standardization. During this process, two man-in-the-middle attacks have been theorized that must be addressed before the standards can be deployed with absolute security.

One attack relies on supplicants performing authentication in the clear when asked to do so; the other attack lies in a lack of cryptographic binding between network layers, which allows a man-in-the-middle to spoof a network identity without detection.

All current support for 802.1x/EAP, tunneled or not, still relies on WEP as the link encryption method, which means that a VPN is still required for definitive link security until WPA with TKIP starts appearing in access points and clients.

As we survey the road ahead, it's clear that the arrival of WPA and eventually 802.11i will reduce the administrative burden of WLANs, integrating them with existing authentication mechanisms and making the security issue disappear.

© 2002 InfoWorld via ProQuest Information and Learning Company i/a/w ScreamingMedia, Inc. All rights reserved.
© 2002 NewsFactor Network. All rights reserved.

Talkback: Click here to add your comment about this story...

See Related Stories

IBM Unveils Dual-Band Wi-Fi Laptop

(29-Jan-03)

Ready or Not, Here Come Wireless LANs

(16-Jan-03)

Wi-Fi in the Workplace

(06-Jan-03)

Wi-Fi Alliance Boosts Security

(01-Nov-02)

As Wi-Fi Spreads, Insecurity Mounts

(01-Aug-02)

Sponsored Links

CIO Today Magazine is available FREE of charge. Subscribe now.

Are IM and P2P Technologies Undermining Your Security? Click here.

Streamline sales & service processes to serve your customers better!

Reach Thousands of Internet Pros Everyday with NewsFactor Newsletters!

February 02, 2003

Sun Releases Java Guidelines for Cell Phones
Full Story

Verizon Delivers Webcam Access
Full Story

Key to Wi-Fi Security
Full Story

Is Now the Time To See SPOT Run?
Full Story

Good's G100 Challenges BlackBerry for Data-Only Dominance
Full Story

The Lord of Mobility
Full Story

IBM Unveils Dual-Band Wi-Fi Laptop
Full Story

Coming of Cometa
Full Story

Recharging Kiosk Empowers Mobile Gadget Users
Full Story

Diagnostic Tool Keeps Bluetooth Connected
Full Story

Wireless LANs To Get Switch Support
Full Story

Cell Phone Users Drive 'Blind'
Full Story

Court Rules for NextWave, Against FCC
Full Story

Global PDA Sales Drop 9 Percent in 2002
Full Story

Upping the SMS Fun Factor
Full Story

Next Stop: Free Wireless Broadband?
Full Story

Wireless Giants Open the Border for Text Messaging
Full Story

Cell Phones Emerge as New Force in Gaming Market
Full Story

Wireless Infrastructure Spending Surge Ahead
Full Story

New WLAN Card Boosts PDA Power
Full Story

CRM in Your Pocket
Full Story

AMD Offers Opteron Test Drive to Speed Adoption
Full Story

Waiting for Bluetooth
Full Story

Java Jumpstart Promises Fast Money for Wireless Carriers
Full Story

For Palm, a Successful Parting
Full Story

See more news

Get news by e-mail

Visit open forums

Wireless NewsFactor

Mobile Devices |
Wireless Web |
Networking |
3G Wireless

Satellite |
M-Commerce |
Big Deals |
Mobile Media |
Health & Safety |
Editorial Corrections

Other NewsFactor Network Sites

NewsFactor Portal |
E-Commerce Times |
TechNewsWorld |
Linux Insider |
Wireless NewsFactor

osOpinion |
TechExtreme |
CRMDaily |
CRM Buyer Magazine

FreeNewsFeed |
Free Newsletters

Business Development |
How To Contact Us |
About NewsFactor Network

How To Advertise |
Article Reprint Information

© 1998-2003 Triad Commerce Group, LLC. All rights reserved. See Terms of Use and Privacy notice.