Securing Fixed and Wireless Networks, COMP 4337/9337
Securing Fixed and Wireless Networks
Hello, dear friend, you can consult us at any time if you have any questions, add WeChat: THEend8_
W02: Stream Ciphers and WLAN Security
Securing Fixed and Wireless Networks, COMP 4337/9337
Professor Sanjay K. Jha
School of Computer Science and Engineering
Today’s Agenda
▪ Stream Ciphers
▪ How to design a flawed Security Protocol:
▪ WEP Case Study
▪ Fixing a flawed Protocol: WPA, WPA2
Two Types of Symmetric Ciphers
▪ Block ciphers (last week – recap)
▪ Break plaintext message in equal-size blocks
▪ Encrypt each block as a unit
▪ Used in may Internet protocols (PGP-secure email, SSL
(secure TCP), IPsec (secure net-transport layer)
▪ Stream ciphers (today)
▪ encrypt one bit at time
▪ Used in secure WLAN
Two Types of Symmetric Ciphers
▪ Process message bit by bit (as a stream)
▪ Ideal for real-time communication
▪ A keystream must not be reused; otherwise, the encrypted
messages can be recovered
Two Types of Symmetric Ciphers Contd.
▪ combine each byte of keystream with byte of plaintext to get
ciphertext:
m(i) = i th unit of message
ks(i) = i th unit of keystream
c(i) = i th unit of ciphertext
c(i) = ks(i) m(i) ( = exclusive or)
m(i) = ks(i) c(i)
Rivest Cipher 4 – RC4
▪ Rivest Cipher 4: Designed by Ron Rivest
▪ A proprietary cipher owned by RSA.com
▪ No longer a trade secret
▪ Ideal for software implementation, as it requires only byte
manipulations
▪ Variable key size (40 to 256 bits), byte-oriented stream cipher
▪ Widely used
▪ SSL, Wireless WEP and WPA, Cellular Digital Packet Data, OpenBSD
pseudo-random number generator
Wired Equivalent Privacy – WEP
▪ How to design a flawed security protocol!
▪ Provide security equivalent to Wired Network
▪ Problem starts with this thinking!
▪ Symmetric key crypto
▪ confidentiality
▪ end host authorisation
▪ data integrity
▪ Efficient
▪ implementable in hardware or software
Symmetric Cipher and Packet Independence
▪ Design goal: each packet separately encrypted
▪ If for frame n+1, use keystream from where we left off for frame n,
then each frame separately encrypted
▪ Ensure that keys are not repeated. i.e., every single frame or
packet requires the generation of a new stream.
Symmetric Cipher and Packet Independence Contd.
▪ WEP approach: initialize keystream with key + new IV for each
frame:
WEP Pre-shared Key
▪ Enter a key (password) on access point and then enter the key on
all devices
▪ This is the pre-shared key, aka WEP Key (Shared Secret).
▪ Not possible to authenticate individuals
▪ hard to distinguish who is using service - needs extra work.
▪ A key compromise for one user means that every device needs to
change new key
▪ Must be distributed to all users securely
WEP Encryption (1)
▪ Sender calculates Integrity Check Value (ICV) over data
▪ for data integrity: uses CRC-32, four-bytes
▪ each side has 104-bit shared key(earlier only 40-bit)
▪ sender creates 24-bit initialization vector (IV), appends to key: gives 128-bit key
▪ sender also appends keyID ( in 8-bit field )
▪ 128-bit key input into pseudo random number generator (PRNG) e.g. RC4 to get
keystream
▪ data in frame + ICV is encrypted with RC4:
▪ Bytes of keystream are XORed with bytes of data & ICV
▪ IV & keyID are appended to encrypted data to create payload
WEP Encryption (2)
New IV for each frame
WEP Decryption
▪ Receiver extracts IV (received in plaintext)
▪ Inputs IV, shared secret key into pseudo random generator, gets keystream
▪ XORs keystream with encrypted data to decrypt data + ICV
▪ Verifies integrity of data with ICV
▪ note: message integrity approach used here is CRC-32 different from MAC
(message authentication code) and signatures (using PKI).
End-point Authentication W/Nonce
Nonce: number (R) used only once –in-a-lifetime
How to prove Alice “live”: Bob sends Alice nonce, R. Alice
must return R, encrypted with shared secret key
WEP Authentication
Notes:
▪ not all APs do it, even if WEP is being used
▪ AP indicates if authentication is necessary in beacon frame
▪ done before association
Breaking 802.11 WEP Encryption
Security hole:
24-bit IV, one IV per frame, -> IVs eventually reused
~16 Million IVs at high speed exhausted in 2 hours
IV transmitted in plaintext -> IV reuse detected
Attack:
Trudy causes Alice to encrypt known plaintext d1 d2 d3 d4
…
Trudy sees: ci = di XOR ki
IV
Trudy knows ci di, so can compute ki
IV = di XOR ci
Trudy knows encrypting key sequence k1
IV k2
IV k3
IV …
Next time IV is used, Trudy can decrypt!
Problems with Linear Checksum
▪ Encrypted CRC-32 used as integrity check Vector (ICV)
▪ Fine for random errors, but not malicious ones
▪ Bits can be changed in packet without decrypting
▪ An attacker can change encrypted content (substitute by
gibberish), compute a CRC over the substituted text and
produce an 802.11 frame that will be accepted by the
receiver.
FMS Attack
▪ Fluhrer, Mantin and Shamir (FMS) attack
▪ For 50% success rate, capture around 5 Million packets on average
▪ Due to inherent weakness in RC4, output of encrypting with first few bytes of key not
random
▪ Certain key values generate predictable pattern of encrypted data
▪ Associated packets have IVs that are “weak”
▪ Initially determine first bytes of key through IVs and then get the rest through
statistical analysis
▪ Encrypted ARP packets can be captured and replayed to get encrypted ARP
response
▪ more in lab
▪ Two versions WPA and WPA2
▪ WPA temporary solution to fix WEP while WPA2 developed
▪ WPA compatible with existing hardware that supported WEP
▪ WPA used Temporal Key Integrity Protocol (TKIP)
▪ Used RC4 for compatibility
▪ Every packet encrypted with unique encryption key
Wi-Fi Protected Access (WPA)
802.11i: WPA - New Features
▪ To provide stronger authentication than in WEP:
▪ Special purpose Message Integrity Code (MIC) as opposed to WEP CRC
▪ To prevent Fluhrer, Mantin and Shamir (FMS) aka FMS-style attacks
▪ a new per-frame key is constructed using a cryptographic hash
▪ Temporal Key Integrity Protocol (TKIP) uses a cryptographic mixing function to
combine a temporal key, the TA (transmitter MAC address), and the sequence
counter into the WEP seed (128 bits)
▪ Pre Shared Key (PSK) AKA WPA-Personal similar to WEP-Key
▪ However, it is not used for encryption
▪ Instead, PSK serves as the seed for hashing the per-frame key
802.11i: WPA Contd.
▪ TKIP changes the per packet key completely after every
single packet
▪ One key for encryption (128 bits)
▪ One key for integrity (64 bits)
802.11i: WPA Contd.
▪ The WEP IV is extended to 48 bits, and used as a packet
sequence counter
▪ A per packet sequence counter is used to prevent
replay attacks
▪ If a packet is received out of order, it is dropped by the
receiving station
802.11 frame with WPA
Recap: WEP vs WPA Security
• WPA temporary solution to fix WEP while WPA2 developed
▪ WEP IV extended to 48-bit IV
▪ Reuse > 100 years for replay of the same IV
▪ RC4 key = Function(WPA Key||IV)
▪ Every packet encrypted with unique encryption key
Recap: WEP vs WPA Security
▪ IV used as a packet sequence space to prevent replay attack
802.11i: WPA2
▪ WPA2 2004
▪ New AP hardware, 30 Million Instructions/sec, RC4 off-load hardware
doesn’t do AES or CCMP
▪ AES-CCMP 128-bit AES
▪ CCMP (Counter Mode with Cipher Block Chaining Message
Authentication Code Protocol)
▪ Improved 4-way handshake and temporary key generation
WPA PSK Weakness – No Exam
▪ WPA, using the Temporal Key Integrity Protocol, was cracked by Erik Tews and
Martin Beck
▪ More in lab
▪ Thomas Roth demonstrated at the 2011 Black Hat conference that WPA PSKs
can be cracked quickly and easily using Amazon's Elastic Compute Cloud
(EC2) service
▪ He cracked his neighbor's WPA password in 20 minutes using a dictionary
attack and a list of 70 million words – Not recommended
▪ The attack only required one instance of Roth's self-made Cloud Cracking
Suite (CCS) tool running in the cloud
▪ It reached about 50,000 PSKs/s
WPA PSK Weakness – No Exam Contd.
▪ The EC2 uses 400 cloud CPUs to launch a dictionary attack on a WPA key for
$17
▪ The attack is based on a list containing 135 million entries which can be
extended to include such optional extras as a German dictionary or an
extended English language word list (284 million entries)
802.11i: WPA3
▪ WPA3 introducedin2018
▪ Backward Compatible
▪ Fixes “Perfect forward Secrecy” problem
▪ Compromise of session key (or private key) may not compromise future sessions.
▪ PSK replaced Simultaneous Authentication of Equals (SAE)
▪ based on the IETF Dragonfly key exchange.
▪ Key-generation process modified.
▪ WPA3-Personal mode uses a 128-bit encryption
▪ WPA3-Enterprise uses 192-bit encryption.
▪ We will look at WPA-3 Enterprise in depth along with Enterprise network
security (802.1X) in later weeks
▪ Explore authentication methods for low-powered device etc yourself and discuss on forum
Open Wifi Security Challenge
▪ Openly accessible networks (OpenSSID) such as at airports or restaurants,
there may neither be PSKs nor certificates
▪ Captive Portals* check your authenticity at logon time (often protected with SSL
to protect against eavesdropping on your password)
▪ Only authenticated clients will receive service as packet filtering is deployed to
only allow accessing the logon page until successful authentication
▪ Once logon authentication has been checked: no further security measures
▪ No protection for your user data
*A captive portal is a web page to which a client is redirected when they connect to a guest SSID.
Open Wi-fi Security Challenge (2)
▪ You can deploy your own measures, e.g. VPN or SSL
▪ Configuration is often tedious or not even supported by communication partner
▪ Performance is affected because of additional (per-packet) overhead
▪ Plus: your session can be stolen by using your MAC & IP addresses!
Opportunistic Wireless Encryption (OWE)
▪ The client and AP use a pairwise secret derived from an initial Diffie–Hellman
key exchange (DHKE).
▪ Essentially agree upon a shared key to be used for encryption of traffic
between the two end-points.
▪ IETF RFC 1180 has details of OWE
▪ Describes how do use DHKE elements during Wi-fi Association.
▪ No prior authentication is needed, it provides “ENCRYPTION”
▪ Improvement over previous no security.
▪ Captive Portal could authenticate – as discussed in previous foil
Acknowledgements
▪ Acknowledgement: foils are adapted mainly from Introduction to Computer
Networks and Cybersecurity by Wu and Irwin, CRC Press (Chapter 21)
▪ Some foils are also from Günter Schäfer, Security in Fixed and Wireless
Networks, Wiley (new edition available in German only, English in 2015)
▪ A few foils are from Adrian Perrig (ETH)
▪ Refer to Cybok Network Security KA Section:7 for brief summary
Message Forgery – Self Read
▪ CRC-32 is linear, which means that it is possible to compute the bit
difference of two CRCs based on the bit difference of the messages over
which they are taken.
▪ Flipping bit n in the message results in a deterministic set of bits in the CRC
that must be flipped to produce a correct checksum on the modified
message.
▪ Because flipping bits carries through after an RC4 decryption, this allows
the attacker to flip arbitrary bits in an encrypted message and correctly
adjust the checksum so that the resulting message appears valid.
Message Forgery – Self Read (2)
▪ Implications:
▪ “Integrity check” does not prevent packet modification
▪ Can maliciously flip bits in packets
▪ Modify active streams!
▪ Bypass access control
▪ Partial knowledge of packet is sufficient