Filter
Top Products
LANCOM Reference Manual LCOS 3.50 ̈ Chapter 11: Wireless LAN – WLAN
228
Wireless LAN – WLAN
The client still can't be 'approved', however, because the access point must
still transmit a further key—the group key, which it uses to transmit broadcast
and multicast packets simultaneously to all stations. This must be determined
unilaterally by the access point, and it is simply transmitted to the station,
which confirms receipt. Since at this point a pairwise key is already installed
on both sides, both of these packets are already encrypted.
After a successful group key handshake, the access point can finally release
the client for normal data transfer. The access point is free to perform a
rekeying again during the session using the same type of packets. In principle,
the client may also request rekeying from the access point.
WPA also takes the case of older WLAN hardware into account, in which the
access point does not support pairwise keys, but only group keys. The first
phase of the handshake in this case proceeds exactly as before, but doesn't
result in the installation of a pairwise key—the group key handshake simply
proceeds in clear text, but an encryption in the EAP packets themselves
prevents an attacker from simply reading the keys.
WPA with passphrase
The handshake described in the previous section runs strictly under WPA, i.e.
the user will never have to define any TKIP or Michael keys. In environments
in which no RADIUS server is available to provide master secrets (for instance
in smaller companies or home networks), WPA therefore provides the PSK
method besides authentication using a RADIUS server; here, the user must
enter a passphrase of 8 to 32 characters on the access point and on all
stations, from which the master secret is calculated along with the SSID used
using a hash procedure. The master secret is therefore constant in such a PSK
network; the nonces ensure, however, that different TKIP keys still result.
In a PSK network—similar to classical WEP—both access security and
confidentiality depend on the passphrase not being divulged to unauthorised
people. As long as this is the case, WPA-PSK provides enormously improved
security against break-ins and eavesdropping over any WEP variant. For larger
installations in which such a passphrase would have to be made known to too
large a user community for it to be kept secret, EAP/802.11i is used in
combination with the key handshake described here.
Negotiation of the
encryption method
The original WEP definition only specified a fixed key length, so that only a
single bit was required in the registration packets from the station and access