ZyXEL ZyAIR G-570S User Manual download pdf (Page 147)

ZyXEL G-570S User’s Guide

Appendix C Wireless LANs 147

TKIP uses 128-bit keys that are dynamically generated and distributed by the authentication

server. It includes a per-packet key mixing function, a Message Integrity Check (MIC) named

Michael, an extended initialization vector (IV) with sequencing rules, and a re-keying

mechanism.

TKIP regularly changes and rotates the encryption keys so that the same encryption key is

never used twice.

The RADIUS server distributes a Pairwise Master Key (PMK) key to the AP that then sets up

a key hierarchy and management system, using the PMK to dynamically generate unique data

encryption keys to encrypt every data packet that is wirelessly communicated between the AP

and the wireless stations. This all happens in the background automatically.

WPA2 AES (Advanced Encryption Standard) is a block cipher that uses a 256-bit

mathematical algorithm called Rijndael.

The Message Integrity Check (MIC) is designed to prevent an attacker from capturing data

packets, altering them and resending them. The MIC provides a strong mathematical function

in which the receiver and the transmitter each compute and then compare the MIC. If they do

not match, it is assumed that the data has been tampered with and the packet is dropped.

By generating unique data encryption keys for every data packet and by creating an integrity

checking mechanism (MIC), TKIP makes it much more difficult to decrypt data on a Wi-Fi

network than WEP, making it difficult for an intruder to break into the network.

The encryption mechanisms used for WPA and WPA-PSK are the same. The only difference

between the two is that WPA-PSK uses a simple common password, instead of user-specific

credentials. The common-password approach makes WPA-PSK susceptible to brute-force

password-guessing attacks but it’s still an improvement over WEP as it employs an easier-to-

use, consistent, single, alphanumeric password.

Roaming

A wireless station is a device with an IEEE 802.11 mode compliant wireless adapter. An

access point (AP) acts as a bridge between the wireless and wired networks. An AP creates its

own wireless coverage area. A wireless station can associate with a particular access point

only if it is within the access point’s coverage area.

In a network environment with multiple access points, wireless stations are able to switch from

one access point to another as they move between the coverage areas. This is roaming. As the

wireless station moves from place to place, it is responsible for choosing the most appropriate

access point depending on the signal strength, network utilization or other factors.

The roaming feature on the access points allows the access points to relay information about

the wireless stations to each other. When a wireless station moves from a coverage area to

another, it scans and uses the channel of a new access point, which then informs the access

points on the LAN about the change. The new information is then propagated to the other

access points on the LAN. An example is shown in Figure 109.

1 2 ... 142 143 144 145 146 147 148 149 150 151 152 ... 161 162

ZyXEL ZyAIR G-570S User Manual Page 147