ZyXEL P-2812HNU-51c User Manual download pdf (Page 477)

Appendix E Wireless LANs

P-2812HNU-51c User’s Guide

477

required for compatibility reasons, but offers stronger encryption than TKIP with

Advanced Encryption Standard (AES) in the Counter mode with Cipher block

chaining Message authentication code Protocol (CCMP).

TKIP uses 128-bit keys that are dynamically generated and distributed by the

authentication server. AES (Advanced Encryption Standard) is a block cipher that

uses a 256-bit mathematical algorithm called Rijndael. They both include a per-

packet key mixing function, a Message Integrity Check (MIC) named Michael, an

extended initialization vector (IV) with sequencing rules, and a re-keying

mechanism.

WPA and WPA2 regularly change and rotate the encryption keys so that the same

encryption key is never used twice.

The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that

then sets up a key hierarchy and management system, using the PMK to

dynamically generate unique data encryption keys to encrypt every data packet

that is wirelessly communicated between the AP and the wireless clients. This all

happens in the background automatically.

The Message Integrity Check (MIC) is designed to prevent an attacker from

capturing data packets, altering them and resending them. The MIC provides a

strong mathematical function in which the receiver and the transmitter each

compute and then compare the MIC. If they do not match, it is assumed that the

data has been tampered with and the packet is dropped.

By generating unique data encryption keys for every data packet and by creating

an integrity checking mechanism (MIC), with TKIP and AES it is more difficult to

decrypt data on a Wi-Fi network than WEP and difficult for an intruder to break

into the network.

The encryption mechanisms used for WPA(2) and WPA(2)-PSK are the same. The

only difference between the two is that WPA(2)-PSK uses a simple common

password, instead of user-specific credentials. The common-password approach

makes WPA(2)-PSK susceptible to brute-force password-guessing attacks but it’s

still an improvement over WEP as it employs a consistent, single, alphanumeric

password to derive a PMK which is used to generate unique temporal encryption

keys. This prevent all wireless devices sharing the same encryption keys. (a

weakness of WEP)

User Authentication

WPA and WPA2 apply IEEE 802.1x and Extensible Authentication Protocol (EAP) to

authenticate wireless clients using an external RADIUS database. WPA2 reduces

the number of key exchange messages from six to four (CCMP 4-way handshake)

and shortens the time required to connect to a network. Other WPA2

authentication features that are different from WPA include key caching and pre-

1 2 ... 472 473 474 475 476 477 478 479 480 481 482 ... 521 522

No comments

ZyXEL P-2812HNU-51c User Manual Page 477