This article is an exploration of the reasons why WPA encryption provides stronger wireless security than WEP encryption in your wireless network
What is WPA encryption?
WiFi Protected Access (WPA) is a newer security standard adopted by the WiFi Alliance consortium. Adhering to WiFi compliance ensures interoperability between different manufacturer’s equipment.
WPA delivers a higher level of security that further beyond anything that WEP can offer and bridges the gaps between WEP and 802.11i networks. WPA has the advantage that the firmware in older equipment may be upgradeable, without new hardware. This is not true for WPA2.
How does WPA work?
WPA uses Temporal Key Integrity Protocol (TKIP). TKIP is designed to allow WEP to be upgraded. This means that all the main building blocks of WEP are present, but corrective measures have been added to address security problems.
The weaknesses in WEP have been well publicized. Cracking methods are now available to comprimise a WEP password in less than 90 seconds. TKIP’s improvements are described below.
How WPA improves on WEP
IV values can be reused/IV length is too short. The length of the IV has been increased from 24bits to 48bits. Rollover of the counter is eliminated. Reuse of keys is less likely.
In addition IVs are now used as a sequence counter, the TSC (TKIP Sequence Counter), protecting against replaying of data, a major vulnerability in WEP.
Weak IV values are susceptible to attack
WPA avoids using known weak IV values. A different secret key is used for each packet, and the way the key is scrambled with the secret key is more complex.
Master keys are used directly in WEP
Master Keys are never used directly in WPA. A hierarchy of keys is used, all derived from the Master. Cryptographically this is a much more secure practice.
Key Management and updating is poorly provided for in WEP
Secure key management is built-in to WPA, so key management isn’t an issue with WPA.
Message integrity checking is ineffective
WEP message integrity proved to be ineffective. WPA uses a Message Integrity Check (MIC) called, Michael! Due to the hardware constraints the check has to be relatively simple. In theory there is a one in a million chance of guessing the correct MIC. In practice any changed frames would first need to pass the TSC and have the correct packet encryption key even to reach the point where Micheal comes into operation. As further security Michael can detect attacks and performs countermeasures to block new attacks.
Conclusion
WPA (TKIP) is a great solution, providing much stronger security than WEP, addressing all the weaknesses and allowing compatibility and upgrades with older equipment.
Recent Comments