Wi-Fi Protected Access

Wi-Fi Protected Access (WPA and WPA2) is a certification program administered by the Wi-Fi Alliance to indicate compliance with the security protocol created by the Wi-Fi Alliance to secure wireless computer networks. This protocol was created in response to several serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy (WEP). The protocol implements the majority of the IEEE 802.11i standard, and was intended as an intermediate measure to take the place of WEP while 802.11i was prepared. The protocol is specifically designed to also work with pre-WPA wireless network interface cards that pre-date the protocol (through firmware upgrades), but not necessarily with first generation wireless access points. The WPA2 certification mark indicates compliance with an advanced protocol that implements the full standard. This advanced protocol will not work with some older network cards.

Products that have successfully completed testing by the Wi-Fi Alliance for compliance with the protocol can bear the Wi-Fi Protected Access certification mark.

"WPA is both forward and backward-compatible and is designed to run on existing Wi-Fi devices as a software download." cite web|work=Wi-Fi Alliance| url=http://www.wi-fi.org/white_papers/whitepaper-042903-wpa/|title=Wi-Fi Protected Access White Paper]

WPA2

The advanced protocol, certified through Wi-Fi Alliance's WPA2 program, implements the mandatory elements of 802.11i. In particular, it introduces a new AES-based algorithm, CCMP, that is considered fully secure. From March 13, 2006, WPA2 certification is mandatory for all new devices wishing to be certified by the Wi-Fi Alliance as "Wi-Fi CERTIFIED."

Security in pre-shared key mode

Pre-shared key mode (PSK, also known as "personal" mode) is designed for home and small office networks that don't require the complexity of an 802.1X authentication server. Each user must enter a passphrase to access the network. The passphrase may be from 8 to 63 printable ASCII characters or 64 hexadecimal digits (256 bits). ["Each character in the pass-phrase must have an encoding in the range of 32 to 126 (decimal), inclusive." (IEEE Std. 802.11i-2004, Annex H.4.1)
The space character is included in this range.] If ASCII characters are used, a hash function reduces the password to a 256 bit string, using also the SSID. Under most operating systems the passphrase may be stored on the user's computer at the user's discretion to avoid the inconvenience of entering it at every connection establishment. The passphrase is also stored in the wireless access point.

Security is strengthened by employing a PBKDF2 key derivation function. However, the weak passphrases users may typically employ are vulnerable to password cracking attacks. To protect against a brute force attack, a truly random passphrase of 13 characters (selected from the set of 95 permitted characters) is probably sufficient. ["A key generated from a passphrase of less than about 20 characters is unlikely to deter attacks." "... against current brute-strength attacks, 96 bits [of security] SHOULD be adequate." ( [http://wifinetnews.com/archives/002452.html Weakness in Passphrase Choice in WPA Interface, by Robert Moskowitz. Retrieved March 2, 2004.] )] Rainbow tables have been computed by the Church of WiFi for the top 1000 SSIDs [http://www.wigle.net/gps/gps/Stat] for a million different WPA/WPA2 passphrases [http://www.renderlab.net/projects/WPA-tables/] . To further protect against intrusion the network's SSID should not match any entry in the top 1000 SSIDs.

Some consumer chip manufacturers have attempted to bypass weak passphrase choice by adding a method of automatically generating and distributing strong keys through a software or hardware interface that uses an external method of adding a new wireless adapter or appliance to a network. These methods include pushing a button (Broadcom SecureEasySetup [ [http://www.broadcom.com/products/secureeasysetup.php Broadcom Corporation - SecureEasySetup Software ] ] and Buffalo AirStation One-Touch Secure System) and entering a short challenge phrase through software (Atheros JumpStart [ [http://www.atheros.com/pt/whitepapers/atheros_JumpStart_for_wireless_whitepaper.pdf JumpStart Whitepaper ] ] and ZyXEL OTISTFact|date=April 2008). The Wi-Fi Alliance has standardized these methods and certifies compliance with these standards through a program called Wi-Fi Protected Setup (formerly Simple Config).

EAP extensions under WPA- and WPA2- Enterprise

The Wi-Fi alliance has announced the inclusion of additional EAP (Extensible Authentication Protocol) types to its certification programs for WPA- and WPA2- Enterprise certification programs. This was to ensure that WPA-Enterprise certified products can interoperate with one another. Previously, only EAP-TLS (Transport Layer Security) was certified by the Wi-Fi alliance.

The EAP types now included in the certification program are:

* EAP-TLS (previously tested)
* EAP-TTLS/MSCHAPv2
* PEAPv0/EAP-MSCHAPv2
* PEAPv1/EAP-GTC
* EAP-SIM

Other EAP types may be supported by 802.1X clients and servers developed by specific firms. This certification is an attempt for popular EAP types to interoperate; their failure to do so is currently one of the major issues preventing rollout of 802.1X on heterogeneous networks.

Hardware support

Most newer Wi-Fi CERTIFIED devices support the security protocols discussed above, out-of-the-box, as compliance with this protocol has been required for a Wi-Fi certification since September 2003. [cite web|work=Wi-Fi Alliance Press Room| url=http://www.wi-fi.org/pressroom_overview.php?newsid=37|title=Wi-Fi Protected Access Security Sees Strong Adoption]

The protocol certified through Wi-Fi Alliance's WPA program (and to a lesser extent WPA2) was specifically designed to also work with wireless hardware that was produced prior to the introduction of the protocol which usually had only supported inadequate security through WEP. Many of these devices support the security protocol after a firmware upgrade. Firmware upgrades are not available for all legacy devices.

References

External links

* [http://www.wi-fi.org/knowledge_center/wpa/ Wi-Fi Alliance's WPA page]
* [http://certifications.wi-fi.org/wbcs_certified_products.php Wi-Fi Alliance's Interoperability Certificate page]
* [http://www.wi-fi.org/OpenSection/eap.asp EAP types supported under WPA-Enterprise]
* [http://www.wifialliance.com/OpenSection/pdf/Whitepaper_Wi-Fi_Security4-29-03.pdf Wi-Fi Alliance. (2003). Wi-Fi Protected Access: Strong, standards-based, interoperable security for today’s Wi-Fi networks. Retrieved March 1, 2004.]
* [http://www.wi-fi.org/opensection/ReleaseDisplay.asp?TID=4&ItemID=165&StrYear=2004&strmonth=2 Wi-Fi Alliance. (2004). Wi-Fi Protected Access security sees strong adoption: Wi-Fi Alliance takes strong position by requiring WPA security for product certification. Retrieved January 5, 2004.]
* [http://wifinetnews.com/archives/002452.html Weakness in Passphrase Choice in WPA Interface, by Robert Moskowitz. Retrieved March 2, 2004.]
* [http://www.wi-fi.org/OpenSection/ReleaseDisplay.asp?TID=4&ItemID=205&StrYear=2005&strmonth=4 Press Release about new EAP types supported under WPA-Enterprise.]
* [http://standards.ieee.org/getieee802/download/802.11i-2004.pdf IEEE Std. 802.11i-2004]
* [http://arstechnica.com/guides/tweaks/wireless-security.ars/1 The ABCs of securing your wireless network - Ars Technica]