Posted on : By : Roméo Diaz Posted in : Non classé

WPA3 Overviewcw

Published by the Wi-Fi Alliance in 2018, the WPA3 protocol is an updated version of the WPA2 protocol released in 2004. This update allows a better security of exchanges as well as an evolution in connection with the development of uses (multiplication of hotspot, IoT, …).

In despite of the progress in terms of security that WPA3 represents, there are some known vulnerabilities, for example online dictionary attacks, which can be blocked with an IDS/IPS, or some of the Frag Attacks vulnerabilities.

The initial version of WPA3 included the different features presented in the following article, however the final version only requires the EAS. The implementation of the other features remains at the free choice of the manufacturers. The DPP has its own certification.

OWE (Opportunistic Wireless Encryption)

Until the introduction of WPA3, public Wi-FIs are usually configured in open mode and therefore do not have a password. The good practice is to set up a captive portal to force people to authenticate. The fact that this network is not protected exposes us to two major risks: passive eavesdropping and man-in-the-middle attacks.

With the implementation of OWE, we will be able to rule out the possibility of passive eavesdropping on traffic. It describes a method for clients and access points to establish an encrypted session based on a Diffie-Hellman key exchange. The session keys are unique and this is transparent to the user.

DPP Device Provisioning Protocol / Easy Connect™

The DPP protocol is being implemented to address the security weaknesses of WPS (Wi-Fi Protected Access) and to facilitate the deployment of IoT objects. Unlike its predecessor with DPP allows authenticating devices on the network without passwords using QR codes or NFC tags.

This feature is not mandatory to obtain the WPA3 certification from the Wi-Fi Alliance, this feature is part of the Easy Connect Wi-fi Certified program.

Protected management Frames

One of the classic attack vectors of WPA2 Personnal is the capture of authentication exchanges that can later allow to perform an offline dictionary attack in order to break the PSK. To do so, the attacker can send deauthentication frames to force the client to initiate a new connection process and thus generate the frames desired by the attacker.

This protection of management frames is not a new feature of WPA3, it existed in previous versions, but it has been further developed.

Simultaneous Authentication of Equals (SAE)

In order to overcome the above-mentioned attack which consists in capturing the handshake and then breaking it offline with a dictionary, WPA3 uses a new key negotiation mechanism based on Dragonfly exchange. During negotiation, the keys are never sent, which eliminates the threat of an attacker capturing the 4-way handshake and then performing an offline attack. This key exchange mechanism is already implemented for 802.11s mesh networks.

Contribution of elliptic curves

One of the first changes in WPA3 compared to WPA2 is the generation of keys. WPA3 introduces the use of elliptic curves in Diffie-Hellman exchanges (DHCE) to reduce the size of the keys and therefore the resources needed for encryption. For example, for a 128-bit AES encryption the public key has a size of 3072 bits with the use of the Modular Exponential algorithm (MODP) against 256 bits with the use of ECDH.

To go further :

WPA3, OWE and DPP | Hemant Chaskar | WLPC Phoenix 2019 | Wireless LAN Professionals

Posted on : By : Roméo Diaz Posted in : Non classé

802.11 retries: Explanation of the most common causes and corrections

Frame retransmissions occur when frames must be resent by a client or access point due to an error. Monitoring the retransmission rate will allow the detection of possible configuration or interference problems, but it is not possible to indicate a threshold for proper operation. Depending on the services used, the maximum rate to ensure proper operation will be different, real time applications or VoIP will require a much lower retransmission rate (<10%) than file transfer or web browsing for example. In the rest of this article we will explain what a high retransmission rate implies and why it can become problematic, and then we will look at the most common causes of retransmissions.

When a unicast frame is not acknowledged by the client it is retransmitted by the sender. This can be due to two factors, either the frame was never received, or the CRC is not valid, which may indicate a corruption of the frame and in this case the receiver does not transmit an acknowledgement frame. This can be in the direction of the client to the access point or vice versa. Following a transmission failure, this will have two impacts on the retransmission:

  • The transmission rate (or MCS) used by the station will be lowered in order to support a low SNR more easily
  • The contention window will double at each attempt in order to detect more easily a possible collision

These actions require time, not only the time of retransmissions of the packet, but also the packet will be sent more slowly with a greater delay.

Here are 3 of the most common reasons for retransmissions:

Interference

Cause:

  • Non 802.11 interference
  • Co Channel Interference

Identification:

  • Spectral analysis
  • Wifi passive survey

Resolution:

  • Identification of interference sources
  • Use of 5GHz or 6GHz (less interference and more available channels)

Weak signal

Cause:

  • Weak signal (area not covered)
  • Roaming problem / Sticky client
  • Incorrect configuration of transmission powers

Identification :

  • Wifi survey (active or passive)
  • Analysis of packet exchanges
  • Audit of configuration and connection logs

Resolution:

  • Activation of lower transmission speeds
  • Re-adjustment of the configuration of the access points and equipment
  • Enable 802.11k and 802.11r functionality to facilitate client roaming

Collisions

Cause:

  • Hidden nodes
  • Too many devices on one access point

Identification:

  • Airtime analysis

Resolution:

  • Perform a redesign of the access point implementation and capacity

The retransmission rate is more important in a wireless network than in a wired network due to the transmission medium. The air is a place of shared transmission between clients, but also with other equipment using other modes of communication or using the same frequencies for other purposes. This cohabitation makes the configuration of our equipment particularly difficult and requires both a good knowledge and understanding of the RF environment but also a regular monitoring of this indicator in addition to regular audits to anticipate possible incidents or disturbances.

Posted on : By : Roméo Diaz Posted in : Non classé

Understand the institutions linked to Wi-Fi

Air is a shared media, so many equipments must be able to communicate at the same time, sometimes with each other and especially without disturbing each other. Moreover, the frequencies used by Wi-Fi are also used by other systems (radar, microwave, presence detector, …) which do not communicate. In order for all this equipment to work in harmony, it is necessary to write standards to define the spaces reserved for each, the conditions of cohabitation and the rules of communication. We therefore find different organizations working together.

Wi-Fi Alliance

The Wi-Fi Alliance (previously named Wireless Ethernet Compatibility Alliance) is a global non-profit organization, founded in 1999. Its mission is to ensure the interoperability of equipment based on the IEEE 802.11 standards. For this purpose, it relies on different programs:

Connectivity: This program aims to ensure that data transmissions are carried out in the expected manner in compliance with 802.11 standards. We currently find the following programs:

  • Wi-Fi 6
  • Wi-Fi ac
  • Wi-Fi Halow (using a frequency band below 1GHz)
  • Wi-Fi n (still maintained for the IoT)
  • Wi-Fi WiGig (using a high performance 60GHz frequency band)
  • Wi-Fi Direct

Security: The equipment must ensure a minimum of security in their exchanges, for this we find the following programs:

  • WPA3
  • Wi-Fi Enhanced Open
  • Protected Management Frames

Access: The equipment can use one of the following methods to authenticate itself on the network:

  • Passpoint (currently being upgraded to Vantage which provides more flexibility)
  • Wi-Fi Easy Connect
  • Wi-Fi Protected Setup (WPS)

Application and services: Various features to enhance the user experience are offered in this program. They include:

  • Miracast (Transmission of HD and UHD video content)
  • Voice enterprise (VoIP enhancement)
  • Wi-Fi Aware (Detection of nearby equipment)
  • Wi-Fi Location (Allows geolocation of equipment without GPS connectivity)

Optimization: This program provides solutions to improve the quality of exchanges, here are some examples of features that we find:

  • Wi-Fi Agile Multiband (Optimization of the choice of terminals and channels)
  • Wi-Fi Optimized Connectivity (Optimizes roaming through quality assessment)
  • Wi-Fi Multimedia (WMM) (Multimedia traffic prioritization)

RF Coexistence: This program assures that Wi-Fi equipment can coexist with other non-802.11 equipment, there is currently only one program that is still under study:

  • CWG-RF which studies the interaction of radios on a cellular and Wi-Fi terminal

Institute of Electrical and Electronics Engineers (IEEE) :

IEEE is a global society with approximately 400,000 employees in 160 countries. The main objective of the IEEE is “To foster innovation and technological excellence in the service of people”. To do this, they create standards on which manufacturers can then build to make equipment interoperable and able to communicate with each other.

In order to write or revise standards, the IEEE sets up working groups to which a number is associated in an incremental manner. The first standard that was written was named 802.1 and is a working group on the interconnection of different networks defined in the following standards. Probably the two most known are 802.3 which corresponds to the standard defining the Ethernet and 802.11 which defines the WLAN type network. Once the standard is defined, it is regularly completed and revised by Tasks Groups and one or more letters are added to the standard number, always in an incremental way.

Internet Engineering Task Force (IETF)

The IETF is a standards organization that develops and promotes Internet standards. It is an open organization where all participants are volunteers and there are no membership requirements. The IETF was initially supported by the U.S. government before becoming in 1994 managed by ISOC (Internet Society) which is also a non-profit organization.

The IETF works around eight main themes which are : Applications, a global theme, Internet, Operations and Management, Applications and Real-Time Infrastructure, Routing, Security and Transport. From these themes, many working groups will be created to participate in the development of RFCs (Request for Comments) that will describe network protocols, services or certain rules that can evolve into a standard. Not all RFCs will become standards. Concerning Wi-Fi, many documents (standards, best practices or information documents) provided by the IETF concern security

International Organization for standardization (named ISO)

ISO is a non-governmental certification organization that is found in many fields (security, management, etc.). From a network point of view, ISO is the basis of the OSI model (Open System Interconnection) which governs all data communications. This model is divided into 7 layers:

Application

Presentation

Session

Transport

Network

Link

Physical

International Telecommunication Union Radiocommunication Sector (ITU-R)

The ITU-R is an organization under the responsibility of the United Nations which is in charge of the Radio Frequency spectrum at the global level in order to avoid interference on land, in the sky and on the sea. It maintains a worldwide basis on frequency allocations. For this, it relies on 5 organizations that manage specific regions:

  • Region A: Americas (Inter-American Telecommunication Commission – CITEL)
  • Region B: Western Europe (European Conference of Postal and Telecommunications Administrations – CEPT)
  • Region C: Eastern Europe and Northern Asia (Regional Commonwealth in the field of Communications – RRC)
  • Region D: Africa (African Telecommunication Union – ATU)
  • Region E: Asia, excluding North Asia and Australia (Asia Pacific Telecommunity – APT)

Within these regions, local regulatory bodies direct the management of the radio-frequency spectrum in their respective areas, in accordance with ITU-R recommendations. Examples of such bodies include:

  • The Federal Communications Commission (FCC) for the United States
  • The European Telecommunications Standards Institute (ETSI) for Europe