802.11 Security – Key Hierarchy

1. 802.11 Security – Key Hierarchy Shambhu Upadhyaya Wireless Network Security CSE 566 (Lecture 17)

2. Mobile Device Mobile Device Mobile Device Key 1 Key 3 Key 2 Pairwise Keys • Unicast data sent between two stations has to be private between them • For this purpose a pairwise key is used which is know to the two parties • Each mobile device has a unique pairwise key with the access point Pairwise Key AP Key 1 Key 2 Key 3

3. Mobile Device Mobile Device Mobile Device Key G Key G Key G Group Keys • For Broadcast or multicast transmissions, data is received by multiple stations • Thus a key needs to be shared by all members of the trusted group • Each trusted mobile device shares this group key with the Access Point Group Key AP Key G

4. Types of Keys • Preshared keys • Installed in the access point and mobile device by some method outside of RSN/WPA • Used by most WEP systems • Possession of the key is the basis for authentication • Bypasses the concept of upper layer authentication completely • Server-based keys • The keys are generated by some upper layer authentication protocol • Authentication server provides the access points with the temporal keys required for session protection

5. Pairwise Key Hierarchy • At the top of the hierarchy is Pairwise Master Key (PMK) • Can be delivered from upper layer authentication protocol or can use a preshared secret • There exists a unique PMK for each mobile host

6. Creation and Delivering of PMK • Generation of the PMK is based on the top level key held by both the user and the server • Could be in a ‘smart card’ or a password known to both the user and the server (kept in a person’s head) • During the EAP authentication process the method proves that both parties know this secret • After successful authentication a key generating authentication process (e.g., TLS, Kerberos) then generates random-like key material • This random key material is used to create the PMK • Thus after the authentication process the PMK is known to both the client and the authentication server • This key needs to be transferred to the Access Point for use during the session • WPA mandates the use of RADIUS to make this transfer • RSN does not specify a particular method for the transfer

7. Computing Temporal Keys • 802.1X model, data can start flowing once access point has the key, but WPA/RSN has more steps • Now temporal keys are derived from this PMK for use during each session • These keys are called temporal keys as they are recomputed each time the mobile device associates with the AP • There are four keys derived for this purpose • Data Encryption Key (128 bits) • Data Integrity Key (128 bits) • EAPOL-Key Encryption Key (128 bits) • EAPOL-Key Integrity Key (128 bits) • Collection of these four keys is called as Pairwise Transient Key (PTK)

8. Details of Temporal Keys • First two keys are used to encrypt and protect the data • Last two are used to protect communication between the access point and mobile device during the initial handshake • As the temporal keys change every time a station reattaches with the AP, liveliness is ensured by including a couple of Nonces in the computation of the temporal keys • A Nonce is a value which is “never” or “extremely unlikely” to be repeated • Each device generates a nonce and passes it to the other device • Also to bind identity of the devices to the keys, MAC addresses of the devices are included in computation

9. Temporal Key Generation Key Computation Block PMK Data Encr Nonce1 Data MIC Nonce2 EAPOL Encr MAC 1 EAPOL MIC MAC 2 Temporal Key Computation

10. Exchanging and Verifying Key Information (Legitimizing AP) • In the above exchange there is an implicit trust between the mobile host and the Access point • To ensure that the Access Point is not rogue, it must authenticate itself with the mobile device • To do this, the access point proves its possession of the PMK which it gets from the authentication server and can only be obtained by a legitimate AP • This is done by carrying out a four-way mutual authentication between the AP and the mobile host using EAPOL Key Messages

11. Access Point’s Legitimacy • Message (A): Authenticator -> Supplicant • Contains the ANonce (nonce from the AP) • Message is send unencrypted • On receiving this message supplicant computes the temporal keys • Message (B): Supplicant -> Authenticator • Contains the SNonce (nonce from the mobile host) • Also contains the MIC (Message Integrity Code) to prevent the message from being tampered • This is done using the EAPOL Key Integrity key from the PTK • The Authenticator calculates the PTK based on the received SNonce

12. Four-way Handshake Contd.. • It now verifies the MIC based on the calculated temporal keys • This MIC check ensures the Authenticator that the supplicant has matching PMK • Message (C): Authenticator -> Supplicant • Message indicates that the authenticator is ready to start using the new set of keys • Also contains a MIC so that supplicant can verify Authenticator’s possession of the PMK • Also contains the start sequence for the first encrypted frame • Message (D): Supplicant -> Authenticator • This acknowledges the completion of the four way handshake • Also indicates that the supplicant would now install the new temporal keys

13. Group Key Hierarchy • Used for broadcast and multicast transmissions • Broadcasts and multicasts can be sent from the access point only • Pairwise keys cannot be used as the same transmission is to be heard by all stations • Hence the same key is shared by all stations and is called the Group key

14. Group Key Hierarchy • Group keys pose a problem when a station leaves the network • The pairwise keys are removed when a station disconnects but the group keys are still valid and can be used by the station to passively listen to the group transmissions • This might be undesirable in some situations • The solution to this problem is to change the group key once a station leaves the network

15. Group Key Hierarchy • Changing and distributing group keys is easier than pairwise keys as there already exists a secure channel (using pairwise keys) over which the group key can be sent • The access point performs the following functions during Group Key Rekeying • Create a 256 bit Group Master Key (GMK) • Derive a Group Transient Key (GTK) from which the temporal keys are obtained • After establishment of each pairwise secure connection • Send GTK to mobile device with current sequence number • Check for acknowledgement of the receipt

16. Group Key Hierarchy • To provide an uninterrupted service, WEP provided the support for multiple keys • Using this, four keys can be installed in a device at a time • Each transmission carries a KeyID which specifies which of the keys to use for decryption • Thus, if during a multicast transmission a station disconnects, the AP can continue transmission using the old key set till the new set of Group keys is calculated and distributed, after which it switches to the new keys set • Also, GMK is not bound to a particular station and hence can be easily chosen by simply choosing a cryptographic quality random number

17. References • Jon Edney and William Arbaugh, Real 802.11 Security, Addison-Wesley, 2004

18. 802.11 Security – TKIP Shambhu Upadhyaya Wireless Network Security CSE 566 (Lecture 18)

19. TKIP • Temporal Key Integrity Protocol • Designed as a wrapper around WEP • Can be implemented in software • Reuses existing WEP hardware • Runs WEP as a sub-component • Quick-fix to the existing WEP problem • New “procedures” around Legacy WEP • Components • Cryptographic message integrity code • Packet sequencing • Per-packet key mixing • Re-keying mechanism

20. TKIP Introduction • Never use the same IV value more than once for any particular session key • Prevents key-stream reuse by a system • Receivers discard any packets whose IV value is less or equal to the last successfully received packet encrypted with the same key • Prevents replay attacks • Regularly generate a new random session key before the IV counter overflows • Prevents key-stream reuse • Provide a more thorough mixing of the IV value and the session key to derive the packet's RC4 key • To “fix” the RC4 Key scheduling issues with WEP

21. Weaknesses of WEP

22. Changes from WEP to TKIP

23. Changes from WEP to TKIP

24. Message Integrity • Essential to security of the message • WEP uses ICV (Integrity Check Value), but it offers no real protection • Thus, ICV is not a part of TKIP security • Basic idea behind computing the MIC (Message Integrity Code) is calculating a checksum over the message bytes so that any modification to the message can be detected • This MIC is combined with a secret key so that only authorised parties can generate and verify the MIC • Many available cryptographic methods can be used for the purpose

25. Message Integrity - Michael • As WEP is required to work over existing hardware it cannot use computationally intensive cryptographic methods • Even if the computations are moved to software level in clients, existing Access Points cannot perform heavy computations • Thus, TKIP uses a method of computing MIC called Michael • Michael uses simple shift and add operations instead of multiplications and hence is usable in TKIP

26. Message Integrity - Michael • Michael operates on MSDUs (MAC Service Data Unit) rather than individual MPDUs (MAC Protocol Data Unit) • Useful as the computation can be performed in the device driver on the computer rather than on the adapter card • Also reduces overhead as MIC is not calculated for each MPDU being sent out • As Michaelis computationally simple, it offers a weak form of security • To counter these drawbacks, it includes a set of countermeasures which are used when an attack is detected

27. Michael Countermeasures • Used to reliably detect attacks and shut down communication to the attacked station for a period of one minute • This is done by disabling keys for a link as soon as the attack is detected • Also has a blackout period of one minute before the keys are reestablished • This can be used by the attacker to launch a DoS attack on the network (theoretically)

28. IV Selection and Use • TKIP has the following major changes in the way IVs are used as compared to WEP • IV Size is increased from 24 to 48 bits • IV has a secondary role as a sequence counter to avoid replay attacks • IVs are constructed so as to avoid certain ‘weak keys’ • Instead of directly appending it with the secret key, IVs are used to generate mixed keys

29. 24 bits 104 bits 32 bits 16 bits Upper IV Lower IV IV d IV Per Packet Key Phase 1 Key Mixing Phase 2 Key Mixing ‘d’ is a dummy byte designed to avoid weak keys MAC Address Session Key IV Use in TKIP Creating the RC4 Encryption Key

30. TSC (TKIP Sequence Counter) • WEP has no protection against replay attacks • In TKIP IV doubles up as a sequence counter to prevent replay attacks • TKIP uses the concept of replay window to implement the counters • The receiver keeps track of the highest TSC and the last 16 TSC values • When a new frame arrives it checks and classifies it as one of the following types • ACCEPT: TSC is larger than the largest seen so far • REJECT: TSC is less than the value of the largest - 16 • WINDOW: TSC is less than the largest, but more than the lower limit

31. Per–Packet Key Mixing • Uses the session keys which are derived from the master keys • Per Packet key mixing mechanism further derives a separate unrelated key for each packet from the session key • To save computation key mixing is divided into two phases • Phase 1 involves data that is relatively static like secret session key, higher order 32 bits of IV, MAC address etc. so that this computation is done infrequently • Phase 2 is quicker to compute and is done for each packet – and used the lower 16 bits of the IV (which increases monotonically with each packet)

32. MSDU for Transmission Michael block Compute MIC Append MIC MIC Key Fragmentation Master Key Key derivation block Encryption Key IV Generation Compute ICV Key Mixing Append ICV to Packet RC4 block Encrypt Append IV & Add MAC Hdr MPDU for Tx TKIP Role in Transmission

33. TKIP MPDU Frame • Initialization Vector (IV) • Key Identifier (ID) • Extended IV • Payload Data • MPDU data • MIC • The MIC value is computed using the Michael algorithm over the entire payload data of the MSDU • Integrity Check Value (ICV) • The checksum value computed over the unencrypted payload data • Frame Check Sequence (FCS) • (CRC) computed over all fields of the MPDU

34. MSDU Accepted Reject if bad MIC, invoke counter-measures Remove & Check Mic Michael block Compute MIC MIC Key Re-Assembly Master Key Key derivation block Encryption Key Reject if bad ICV RC4 block Decrypt Key Mixing TSC block Reject if bad TSC IV Extraction Check TSC Window Strip MAC Hdr Received MPDU TKIP Role in Reception

35. References • Jon Edney and William Arbaugh, Real 802.11 Security, Addison-Wesley, 2004