3

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is :

How is the authentication used in WPA different from that used in WEP from a user's perspective?

Whether I am accessing an open network using WEP encryption ("Security Type" set to "Open" in Windows 7 for example) or I use one of the WPA variants for authentication, in both cases I simply type in the network security key associated with that network's router. So how is one doing more "authentication" than the other?

Jedi
  • 3,906
  • 2
  • 24
  • 42
N.S.
  • 131
  • 2
  • 1
    Why should they be different? – JOW Jul 21 '16 at 13:00
  • @JOW: because in one case the "Security Type" box says "Open (No authentication)" and in the other case it does not! Several articles also hint at a difference but besides getting caught up in details of an authentication server aren't clear about the difference in a nutshell – N.S. Jul 25 '16 at 11:33
  • Are you trying to prevent hacks of your wireless signals? If so, then you should use the strongest encryption that your devices allow. In an open connection, like at an airport, you might be better of with a VPN so everything is scrambled. Can you give us more context as to why you are asking this? – SDsolar May 25 '17 at 06:23

3 Answers3

2

Though you wanted to know the authentication part, here I will be trying to explain a bit more than that which may help us build up some basics about this.

WLAN Encryption Methods: 5 types -

  1. 802.11 Legacy or WEP
  2. WPA Personal
  3. WPA Enterprise
  4. WPA2 Personal-802.11i
  5. WPA2 Enterprise-802.11i

Wired Equivalence Privacy (WEP): IEEE released the initial 802.11 standard, all of the security relied on the Wired Equivalent Privacy(WEP) algorithm. This algorithm was responsible for both authentication and encryption. WEP support 40-bit key and 104-bit key with 24bit IV. The procedure of authentication and encryption of user end are described bellow:

  1. Generating a unique key using 24-bit random IV (Initialization vector) + 40/104 bit key.
  2. Generating a random number stream with RC4 using the unique key.
  3. Generating the hash value using CRC-32 of the plaintext message.
  4. Append the hash value with plaintext message to create payload.
  5. Then the payload gets encrypted with random number stream (created by RC4 at step 2) to create Cipher text.
  6. Then cipher text append with same 24-bit IV (used at step 1) in plaintext and transmitted to air.

Decryption procedure (AP end) is slightly reverse the procedure above.

WiFi Protected Access (WPA): WiFi protected access or WPA is also known as 802.11i. This is a whole lot more complicated than WEP. But to make things simple I will skip lots of detailed concepts. Let's see how 802.11i works.

802.11i consist of following phases:

1. Key Configuration: Dynamic encryption key management is much more complicated under the 802.11i. In this phase Access Point and client, both will engage in a key generation mechanism just to securely transmit broadcast and multicast traffic. Procedure at client-end are:

  1. Store your Pre-shared key as Pairwise Master Key(PMK)
  2. Create Pairwise Transient Key(PTK) from Pairwise Master Key.
  3. Dividing pairewise transient key into 3 important key. i) KCK ii) KEK iii) Temporal Key (TK)
  4. Temporal Key is then used for unicast frame encryption and further used as an input key at the encryption phase.

Access Point also goes through several steps to create a key called GTK (Group Temporal Key).

2. Authentication: To authenticate, 802.11i follows the following procedure:

  1. Initiation: By frequently transmitting EAP-request(Extensible Authentication Protocol) frame to AP/Client from Client/AP, any one of them responds with EAP-respond frame which includes devices MAC address. Then AP forward this response to the authentication server (RADIUS SERVER).
  2. EAP Negotiation: After having EAP-respond from AP, authentication server then forwards request to follow EAP procedure to AP and then AP send that to Client.
  3. If the client agrees with that procedure then client complete authentication by following EAP. If everything goes smoothly, the authentication server generates a Master Session Key(MSK) and delivers it to the client and then to the AP. The client and AP derive the PMK from the MSK and then begin the 4-way handshake

3. 4-way handshake: After completing authentication successfully Client and Access Point engaged in a 4-way handshake to establish a connection. 4-way handshake has shown bellow are drawn with ASCIIFlow.com and shamelessly copied fromThe Evolution of 802.11 wireless security by Kevin Benton

 +----------------+            +-----------------+
 |     Client     |            |   Access Point  |
 +-------+--------+            +--------+--------+
         |                              |
         |                     +--------+--------+
         |Cleartext "AckNounce"| Generating a    |
         |   <-----------------+ random Number   |
         |           1         | "AckNounce"     |
+--------+--------+            |                 |
| Generating a    |            +--------+--------+
| random number   |                     |
| "SynNounce"     |                     |
|                 |                     |
+--------+--------+                     |
         |                              |
+--------+--------+ Cleartext SynNounce |
|PTK=PRF(PMK,     | +KCK - Encrypted    |
|Client Mac,      | MIC                 |
|AP MAC, AckNounce+----------------->   |
|,SynNounce       |        2            |
+---------+-------+                     |
          |                    +--------+--------+
          |                    |                 |
          | KEK - Encrypted GTK|PTK=PRF(PMK,     |
          | + KCK - Encrypted  |Client Mac,      |
          | MIC                |AP MAC, AckNounce|
          |   <----------------+,SynNounce       |
+---------+-------+    3       +--------+--------+
|                 | KEK - Encrypted GTK |
| Verifies AP     | + KCK - Encrypted   |
| if AP has correct MIC                 |
| PTK by          |                     |
| decrypting      +---------------->    |
| Messege and M IC|       4             |
|                 |            +--------+--------+
+---------+-------+            |Verifies AP      |
          |                    |if AP has correc |
          |                    |PTK by           |
          |                    |decrypting       |
          |                    |Messege and M IC |
          |                    +--------+--------+
          |                             |
          +                             +

4. Encryption: When client successfully complete key configuration, authentication, and 4-way handshake then regular traffic get encrypted by Temporal Key Integrity Protocol (TKIP) or the Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (CCMP). Both TKIP and CCMP use Temporal Key as input key for encrypting traffic.

Basic difference between these 5 methods are,

+------------------------+--------------------------------------------------------------+
|Standard                | Authentication method      |Encryption Method  |Cipher       |
+---------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------+
|802.11 / WEP            | Open System or Shared Key  |WEP                |RC4          |
+---------------------------------------------------------------------------------------+
|WPA Personal            | WPA Passphrase             |TKIP               |RC4          |
+---------------------------------------------------------------------------------------+
|WPA Enterprise          | 802.1x/EAP                 |TKIP               |RC4          |
+---------------------------------------------------------------------------------------+
|WPA2 Personal/802.11i   | WPA2 Passphrase            |CCMP (default)     |AES (default)|
|                        |                            |TKIP (optional)    |RC4 (optional|
+---------------------------------------------------------------------------------------+
|WPA2 Enterprise/802.11i | 802.1x/EAP                 |CCMP(default)      |AES (default)|
|                        |                            |TKIP (optional)    |RC4 (optional|
+------------------------+--------------------------------------------------------------+
multithr3at3d
  • 12,355
  • 3
  • 29
  • 42
arif
  • 1,088
  • 13
  • 24
  • This is wrong: "*WPA is also known as 802.1x*." WPA is draft 802.11i with a few modifications and WPA2 is 802.11i. Both can use the Enterprise authentication process which makes use of 802.1X (yes, the capital "X" has meaning), but 802.1X is used with wired network authentication as well. WPA also follows the same 802.1X process described for authentication. The key configuration process described is mostly correct for PSK but this doesn't take place when 802.1X is used. Lots of errors here. – YLearn Oct 22 '17 at 16:00
  • While informative, this answer does not address the original question with emphasis on _"from the user's perspective"_. – multithr3at3d Apr 21 '18 at 00:36
1

First off:

Open System Authentication is the default authentication protocol for the 802.11 standard. It consists of a simple authentication request containing the station ID and an authentication response containing success or failure data. Upon successful authentication, both stations are considered mutually authenticated - From Here

WEP has two kinds of Authentication

  • Open Authentication: No Key is involved here. No authentication happens really. WEP is used just for Encryption Only.

  • Shared Key Authentication: requires the Shared Key.

WPA Authentication Types:

  • WPA Personal: uses a shared Key
  • WPA Enterprise: uses an authentication Server

Note that no Open Authentication method is available with WPA!

So Why do routers have WEP(open) enabled and WEP(Shared) disabled?

they just want to provide users with a method to authenticate without a Password, so they provide the option to use WEP(Open).

But, if the users want to authenticate, then they might as well use WPA which is much safer.

At first glance, it might seem as though Shared Key authentication is more secure than Open System authentication, since the latter offers no real authentication. However, it is quite the reverse. It is possible to derive the keystream used for the handshake by capturing the challenge frames in Shared Key authentication.[10] Therefore, data can be more easily intercepted and decrypted with Shared Key authentication than with Open System authentication. If privacy is a primary concern, it is more advisable to use Open System authentication for WEP authentication, rather than Shared Key authentication; however, this also means that any WLAN client can connect to the AP. (Both authentication mechanisms are weak; Shared Key WEP is deprecated in favor of WPA/WPA2.) - Wikipedia

JOW
  • 2,319
  • 2
  • 16
  • 24
  • So if I understand your answer correctly, you're saying that in WEP (open), the network key is used only for encryption, and the devices connecting to the network aren't really authenticated, ie they just need to provide some "id" and join in, meaning spoofing is possible. However, in WPA, I assume the network key is still used for encryption but there is some kind of *additional* SharedKey provided. When and where do devices provide this shared key? – N.S. Aug 20 '16 at 22:16
  • 1
    @S.N in the case of psk it's the password you need to connect to the network. – GnP Aug 28 '16 at 19:09
  • @GnP: so in psk the same key is used to encrypt and authenticate? – N.S. Aug 31 '16 at 17:43
  • @S.N. yes. but the money is on how it is done. if you are interested, check out the CCMP protocol used by WPA2 for both encryption and authentication. you will then realize the complexity involved in achieving it. – JOW Sep 08 '16 at 14:50
0

Leaving security conisderations aside, in WEP user must enter 5 ( 40/64bit encryption ) or 13 ( 104/128bit encryption ) characters. In WPA/WPA2 PSK user enters 8-63 characters. I've seen very old WEP implementations where WEP could be entered in hexademical notation.