IT Jobs
A wireless LAN security glossary
What does it all mean? Check here...
By Kevin Fogarty, Network World | Network World US
Published: 01:00 GMT, 04 April 05
Wireless security has evolved from an inadequate early level to one which Wired Equivalent Privacy, the original wireless security protocol, used 40-digit and 128-digit keys encrypted using an algorithm called RC4. With WEP, each client machine was assigned one key per session. WEP was cracked in the summer of 2001 and has since been a weak link in the wireless security chain.
Combining WEP with the 802.1X authentication protocol improved things by forcing a WEP client to ask for access to the network, using the Extensible Authentication Protocol (EAP) built into 802.1X.
Wireless vendors developed Wi-Fi Protected Access (WPA) to increase the encryption by using another technique called Temporal Key Integration Protocol (TKIP), which changes the key used by each client several times during each session.
A major part of WPA's security was to come from the replacement of RC4 with a stronger algorithm called the Advanced Encryption Standard (AES), which was developed for the U.S. military by the National Institute of Standards.
Developing the protocol using AES and getting all the vendors to sign off on the specifics took time the vendors didn't have, however. To meet rising demand, most released products that used TKIP instead of AES, and it was still called WPA.
The fully baked version of 802.11i, which many vendors and integrators still refer to as WPA2, replaces TKIP with AES, and wasn't approved by the IEEE until June 2004.
Products have been undergoing compatibility testing at the labs of the Wi-Fi Alliance - a consortium of vendors that develops and certifies wireless specifications, and started to hit the market early this year.
- 802.1X: An authentication standard for LANs and WLANs, used to identify users before allowing their traffic onto the network.
- 802.11i: In addition to all the features in WPA, 802.11i uses Advanced Encryption Standard (AES) as a replacement for RC4 encryption.
- Advanced Encryption Standard (AES): AES is the US government standard encryption protocol that replaces Data Encryption Standard.
- Certificate authority: Independent organisations that verify the identities of internal or external network security servers, and give those servers the ability to do the same for clients that connect to them, using encrypted certificates that are verified by the server every time the client logs on.
- Extensible Authentication Protocol (EAP): An extension of Point-to-Point Protocol that supports many authentication methods, including Kerberos, public-key authentication and smart cards. In the IEEE's 802.1X, EAP is encapsulated in LAN or WLAN traffic, providing the mechanism for verifying the identity of a user to a RADIUS or other authentication server. There are several varieties of EAP, listed below and explained here
- EAP-Transport Layer Security (EAP-TLS): a Microsoft-created proprietary extension, but this one has been accepted by the IETF as a public standard.
- EAP-Tunneled Transport Layer Security (EAP-TTLS): a proprietary protocol developed by Funk Software and Certicom; under consideration by IETF as a new standard.
- Lightweight Extensible Authentication Protocol (LEAP): a proprietary version of EAP that Cisco developed.
- Protected Extensible Authentication Protocol (PEAP): a proprietary, extended-function version of EAP that Microsoft, Cisco and RSA Security developed.
- Temporal Key Integrity Protocol (TKIP): an encryption protocol designed to provide more secure wireless encryption than WEP by making keys more difficult to crack. TKIP is the encryption mechanism for WPA, but is replaced by AES in 802.11i, which is also known as WPA2.
- Wired Equivalent Privacy (WEP): An encryption technique built into 802.11 wireless LANs using 40-bit keys.
- Wi-Fi Protected Access (WPA): An industry standard based on a subset of an early draft of 802.11i. WPA replaces WEP's keying mechanism with a more robust system, called Temporal Key Integrity Protocol (TKIP). WPA adds a strong message-integrity check and allows for authentication using 802.1X.
.gif)
Add your commentComments