Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Is there a reason, why in pre-shared key mode, Wi-Fi session key is not secured with something like Diffie-Hellman but instead is derived from PSK key and some information exchanged in clear during sign-on?

share|improve this question
    
If you already have shared some secret data (as "pre-shared key mode" seems to imply) then you don't need to perform a public key exchange. You probably just exchange a nonce to agree on the derived encryption key and be on your way. –  Thomas Jan 7 '13 at 7:19
1  
@Thomas I disagree for several reasons. 1) Password entropy is often low, so using them only for authentication and not for confidentiality seems appropriate 2) Forward secrecy 3) All users who share a WiFi network can read each other's traffic. With a well constructed protocol an attack would have to be active, and one might even bind to the access spot's key, giving a warning when it changes. –  CodesInChaos Jan 7 '13 at 9:42
    
@CodesInChaos I would like to clarify your comment a bit since it seems to be worded in a way that can be easily misconstrued. All users who share a WPA/WPA2 PSK WiFi network can not read each other's traffic unless they have the 4-way handshake from the beginning of the other client's session. The PTK is derived from the PMK but also adds entropy via the SNonce, ANonce, and MAC addresses of both sides which is exchanged in the 4-way handshake. The only thing that all clients on a WPA/WPA2 PSK wifi network can decrypt are Multi/Broadcast packets (See: GMK/GTK). –  Steel City Hacker Jan 7 '13 at 13:32
    
@Steel City Hacker However, it is trivial to send a forged DEAUTH to force another station to initiate another 4-way handshake at any time. So while your statement is technically correct, in practice the difference is immaterial. –  Stubabe Nov 1 '13 at 19:17
    
@Stubabe Agreed. If you aren't using 802.11w, deauths are a piece of cake. That being said, I've never actually seen a corporation use 802.11w. –  Steel City Hacker Nov 3 '13 at 12:14

3 Answers 3

up vote 2 down vote accepted

As Thomas pointed out in his comment, in WPA-PSK the parties already have a shared secret (the pre-shared key), so there is no need to go through the step of Diffie-Hellman key-exchange, which is a way for parties to agree on a shared key when they don't have any secrets in common to begin with.

In WPA, the client and the access point goes through a step known as the "4-way-handshake" to verify that the other party is in possession of the pre-shared key and to derive session keys for actual (encryption/authentication) usage. This step involves nonces from both sides, and some cryptographic computations, with the end result that 1) both parties can verify that the other party is in possession of the common secret and 2) they both have derived a shared session key which they will use for the actual encryption.

The picture below shows the steps in this process. The Supplicant is the client and the Authenticator is the access point. The PMK is the shared secret. In a typical home-user setup, the PMK is usually derived from a password using PBKDF (this password is what you normally punch in when connecting to a wireless network). The PTK is the derived key that they end up actually using for encryption.

enter image description here

share|improve this answer
    
They only have a weak long term secret in common. Those aren't good keys for encryption. –  CodesInChaos Jan 7 '13 at 9:43
    
Yeah, I was a little sloppy in my explanation. I've edited the answer to (hopefully) clarify some of the uses. –  hakoja Jan 7 '13 at 9:50
    
@hakoja It is worth noting that the PMK is not only derived from the password "using PBKDF," but actually comes from function PBKDF2(Passphrase, SSID, ssidlen, 4096, 256) where Passphrase is the shared key, SSID is the ESSID name, ssidlen is the length of the ESSID, 4096 is the number of times the information is hashed via SHA1, and 256 is the output key length. The PMK for ESSID "Linksys" is not the same as the PMK for ESSID "Cisco" even if the Nonces, MACs, and passphrases would be exactly the same. –  Steel City Hacker Jan 7 '13 at 13:36
1  
If i sniff the 4-way handshake and know PSK, then can i decrypt others connection? If yes, then Diffie-Hellman should have prevented this? I frequently share my PSK password with friends, and i didn't expect, that they could sniff my own traffic. –  Michael Jan 7 '13 at 14:55
1  
Michael already suggested a method that provides stronger security: A Diffie-Hellman exchange. This would require an attacker to actively perform a man-in-the-middle-attack, as opposed to starting Wireshark and entering the PSK. I'm also wondering why they didn't implement it like that. –  lxgr Feb 17 '13 at 18:30

It's the same reason why open WIFI isn't encrypted. It is feasible and we have the technology and means, but the problem lies in our inefficient nature as humans.

It makes perfect sense to use Diffie-Hellman/RSA, yet someone up there decided to standardize it in a non optimal way. The world is inefficient and standards move slower than mountains, numerous sub-optimal solutions are employed all across the world in all fields, not just cryptography.

In PSK, anyone who knows the pre-shared key and who has eavesdropped on the 4-way handshake gains un-encrypted access to your traffic. Using Diffie-Hellman/RSA cryptography would eliminate that weakness.

Also, achieving the WPA-Enterprise level of authentication is as simple as checking the wireless station's public key signature. That would prevent MITM. A simple example would be a small LED screen on a router, showing the public key signature. When the user connects to the hotspot for the first time, he has to confirm the public key signature is correct. If the signature changes in the future, the user gets a security warning. The LED screen was just an example, the key signature can be conveyed to the user in a variety of ways.

Some comments state that a Diffie-Hellman/RSA is redundant because you already have a key. That's a false statement because in this scenario Diffie-Hellman/RSA offers a clear advantage, thus it is NOT redundant.

WPA-Enterprise does solve the problem but it adds unnecessary complexity. Albert Einstein would love WPA with RSA/Diffie-Hellman.

"Keep it as simple as possible, but not simpler". -Albert Einstein

share|improve this answer
1  
Using a shared secret allows a malicious member station to MITM the DH key exchanges (and subsequent traffic) between the AP and its peers. While such a MITM may be challenging to perform (e.g. you must jam legitimate signals between the peers and AP) the public key exchange does not provide good cryptographic isolation in the malicious member station scenario. Contrary to your suggestion only WPA/Enterprise can offer that (no common secret shared between stations). DH only acts to strengthen the shared secret and force 3rd party attacks to be active ones against the AP as opposed to offline. –  Stubabe Nov 1 '13 at 19:28
    
Does what you're describing apply to RSA? –  Hello World Jan 30 at 5:52

Using DH with public keys signed by the network wide PSK does not prevent station performing MITM attacks on each other. Further, if the PSK is weak a brute force attack on the signature applied to the public key can be a viable off line strategy. Subsequently to determining the PSK, the unauthorised 3rd party could then use the MITM attack to decrypt legitimate traffic. While this is technically challenging (from a radio perspective) cryptographically it appears to add little protection beyond perfect Forward Secrecy when compared to the existing PSK method.

Of course, stations should only do a single DH exchange on their 1st association to an AP but the open problem of the lack of authentication of WiFi management frames (e.g. spoofing failed association responses) and lack of user interaction at the AP (e.g. unlike Bluetooth pairing) opens an attack vector to induce DH exchanges on demand (as is currently possible with the 4-way handshake). In conclusion, DH with PSK signatures therefore raises the cost and complexity to perform an attack on the system but nowhere near as much is it does with other protocols that were more securely designed (e.g. IPsec).

Considering WPA-Enterprise offers (with the right EAP choice) per user keying and isolation, brute force resilience, and possibly even inter-session PFS. It offers all the same features discussed as advantageous with PSK-DH plus better access management (users can be de-authorised from the system without rekeying and restricted to certain login times or even to particular VLANS). I see why WPA-PSK was relegated to the a low cost/complexity consumer option. The few consumers that are privacy concerned (as opposed to just stopping their neighbours free loading) can obviously choose better PSKs and employ separate guest networks.

Probably, not the answer you wanted to hear but as "Hello World" alluded to PR and sales and profit margin is what drives a lot of these specs...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.