Tags

, ,

Here is my notes about Chapter 3 (Encryption Ciphers & Methods) of CWSP Study Guide.

Symmetric & Asymmetric Algorithms
In symmetric algorithm, both the encrypting & decrypting parties share the same key. WEP, TKIP & CCMP are encryption methods that all use symmetric algorithms.These methods are less processor intensive compare to asymmetric algorithms, so much faster.

Asymmetric algorithm use a pair of keys, one key used for encryption & the other key used for decryption. The decryption key is kept secret & is known as “private key” or “secret key“. The encryption key is shared and is referred as “public key“. Below shows the asymmetric key usage (page 68 – CWSP Official Study Guide)CWSP-TKIP-02 Stream Ciphers Vs Block Ciphers
During cryptographic process, the plaintext needs to be combine with random data bits to create ciphertext. If this task perform sequentially bit by bit basis, those ciphers known as “stream ciphers“. A stream ciphers is a symmetric key cipher where plaintext bits are combined  with a pseudo-random cipher called keystream.

Unlike stream ciphers, a block cipher takes fixed length block of plaintext & generate a block of ciphertext of the same length. Most block ciphers are designed to apply a simpler function repeatedly to the block. Each iterative process or function is referred as “round“.

RC4– Stream Cipher
RC5– Block Cipher (32,64,128 bit blocks, 0-2040 bit key, 0-255 rounds)
DES– Block Cipher (64bit block & 64bit key [56bit effective], 16 rounds)
3DES – Block Cipher (168bit effective key size + 24bits for parity)
AES – Block Cipher (128,192 & 256bit block size)

Here are the details about TKIP– Temporal Key Integrity Protocol encryption method.

* TKIP was created to replace WEP after WEP encryption was broken.
* IEEE 802.11-2007 defined 2 RSNA data confidentiality & integrity protocol (CCMP & TKIP) with TKIP support is optional.
* In 2003 WiFi alliance introduced WPA(Wi-Fi Protected Access) which require TKIP encryption.
* Following TKIP enhancement address the known WEP weaknesses
1. Temporal Keys – to defeat social engineering attacks
2. Sequencing – to defeat replay & injection attacks
3. Key Mixing – to defeat the known IV collisions & weak-key attacks
4. Enhanced Data Integrity(MIC) – to defeat bit-flipping & forgery attacks
5. TKIP Countermeasures – to address constraints of TKIP MIC

Below shows TKIP Encryption & Data Integrity Process (Fig 3.6 – Page 78 CWSP Official Certificate Guide)

CWSP-TKIP-03* TKIP use dynamically generated 128bit key.
* This key can either be a PTK–Pairwise Transient Key used to encrypt unicast traffic or GTK–Group Temporal Key used to encrypt broadcast & multicast key.
* TKIP use 2 phase key mixing process.
* 48-bit TKIP Sequence Counter (TSC) is generated & broken into 6 octets (TSC0-TSC5)
* Phase 1 key mixing us 128-bit temporal key (TK) with TSC2-TSC5 as well as Tranmit Address (TA)
* Output of phase 1 is known as TKIP-mixed transmit address & key (TTAK)
* Phase 2 key mixing combines, TTAK with TSC0-TSC1 with 128 bit TK.
* Output of the phase 2 is known as “WEP seed”
* WEP seed is then run through ARC4 algorithm & key stream is created.
* WEP seed is represented as WEP Initialization Vector(IV) & 104 bit WEP keys.
* Extend IV created by TSC2-5 of key mixing phase2
* IV & Extended IV (8 byte in total) called TKIP header.

Below shows the TKIP MPDU (Fig 3.7 in page 81 – CWSP Official Study Guide)

CWSP-TKIP-04* TKIP uses Message Integrity Code(MIC) also named as “Michael”
* MIC is computed using Destination Address (DA), Source Address (SA), MSDU priority and plaintext Data.
* MIC is 8 octet in size & labeled M0 to M7.
* MIC contain only 20bits of effective security strength & so below TKIP countermeasures are in-placed.
      1. MIC failures will be logged
      2. If two MIC failures occur within 60s STA or AP must disable all reception of TKIP frames for 60s.
      3.Key refresh- PTK & GTK should be changed.
* TKIP MIC does not replace WEP ICV (32bit), but augments it.
* WEP ICV helps prevent false detection of MIC failures that would cause TKIP countermeasure to be invoked.
* MPDU+MIC+ICV  used to perform XOR with Keystream to generated encrypted payload.
* Frame Check Sequence(FCS) is calculated over all of the header & entire frame body resulting 32bit CRC placed in FCS field.
* before MIC verification, receiving STA check FCS, ICV & TSC of all MPDU.* In total TKIP add 20 byte (4-IV, 4-ExIV, 8-MIC, 4-ICV) overhead. So max MPDU with TKIP can be 2324 byte (2304 +20).

Referece:
1. CWSP Official Study Guide- Chapter 3

Related Posts

1. CWSP – CCMP Encryption Methods