Filter
Top Products
̈ Chapter 11: Wireless LAN – WLAN LANCOM Reference Manual LCOS 3.50
229
Wireless LAN – WLAN
point to show whether encryption should be used or not. This became
insufficient the moment WEP was used with key lengths other than 40 bits—
the user just had to take care that not only the same value but that the same
length was defined as well. WPA provides a mechanism with which client and
access point can agree on the encryption and authentication procedures to be
used. For this purpose, a new info element was defined which can contain the
following:
̈ The encryption method to be used for broadcasts in this network (also the
type of group key). Each client wanting to register in a WPA-WLAN must
support this procedure. Here, besides TKIP, WEP is also still allowed, in
order to support mixed WEP/WPA networks—in a pure WPA network,
TKIP will be selected.
̈ A list of encryption methods which the access point provides for the
pairwise key—here, WEP is explicitly disallowed.
̈ A list of authentication methods a client may use to show itself to the
WLAN as authorised for access—possible methods are currently EAP/
802.1x or PSK.
The access point broadcasts such an element with its beacons, so that clients
know whether this network is suitable for them or not. When registering at
the access point, the client sends another such packet, in which it gives the
desired type of pairwise key as well as its authentication scheme. The access
point then starts either the EAP/802.1x negotiation, or starts directly with the
key handshake.
Since neither beacons nor registration packets are cryptographically secured,
it is possible that a third party might interfere in this exchange and force the
client and/or the access point down onto a weaker method than the one
actually desired. Both the access point and the client are therefore required to
exchange these info elements again during the key handshake, and if the
element received doesn't match the one from the registration, they
immediately break the connection.
As mentioned, the original WPA standard specifies only TKIP/Michael as an
improved encryption method. With the further development of the 802.11i
standard, the AES/CCM method described below was added. In a WPA
network it is now possible for some clients to communicate with the access
point using TKIP, while other clients use AES.