Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 2 down vote favorite
1

Is there a reason, why in pre-shared key mode, Wi-Fi session key is not secured with something like Diffie-Hellman but instead is derived from PSK key and some information exchanged in clear during sign-on?

share|improve this question
If you already have shared some secret data (as "pre-shared key mode" seems to imply) then you don't need to perform a public key exchange. You probably just exchange a nonce to agree on the derived encryption key and be on your way. – Thomas Jan 7 at 7:19
1  
@Thomas I disagree for several reasons. 1) Password entropy is often low, so using them only for authentication and not for confidentiality seems appropriate 2) Forward secrecy 3) All users who share a WiFi network can read each other's traffic. With a well constructed protocol an attack would have to be active, and one might even bind to the access spot's key, giving a warning when it changes. – CodesInChaos Jan 7 at 9:42
@CodesInChaos I would like to clarify your comment a bit since it seems to be worded in a way that can be easily misconstrued. All users who share a WPA/WPA2 PSK WiFi network can not read each other's traffic unless they have the 4-way handshake from the beginning of the other client's session. The PTK is derived from the PMK but also adds entropy via the SNonce, ANonce, and MAC addresses of both sides which is exchanged in the 4-way handshake. The only thing that all clients on a WPA/WPA2 PSK wifi network can decrypt are Multi/Broadcast packets (See: GMK/GTK). – Steel City Hacker Jan 7 at 13:32

1 Answer

up vote 2 down vote accepted

As Thomas pointed out in his comment, in WPA-PSK the parties already have a shared secret (the pre-shared key), so there is no need to go through the step of Diffie-Hellman key-exchange, which is a way for parties to agree on a shared key when they don't have any secrets in common to begin with.

In WPA, the client and the access point goes through a step known as the "4-way-handshake" to verify that the other party is in possession of the pre-shared key and to derive session keys for actual (encryption/authentication) usage. This step involves nonces from both sides, and some cryptographic computations, with the end result that 1) both parties can verify that the other party is in possession of the common secret and 2) they both have derived a shared session key which they will use for the actual encryption.

The picture below shows the steps in this process. The Supplicant is the client and the Authenticator is the access point. The PMK is the shared secret. In a typical home-user setup, the PMK is usually derived from a password using PBKDF (this password is what you normally punch in when connecting to a wireless network). The PTK is the derived key that they end up actually using for encryption.

enter image description here

share|improve this answer
They only have a weak long term secret in common. Those aren't good keys for encryption. – CodesInChaos Jan 7 at 9:43
Yeah, I was a little sloppy in my explanation. I've edited the answer to (hopefully) clarify some of the uses. – hakoja Jan 7 at 9:50
@hakoja It is worth noting that the PMK is not only derived from the password "using PBKDF," but actually comes from function PBKDF2(Passphrase, SSID, ssidlen, 4096, 256) where Passphrase is the shared key, SSID is the ESSID name, ssidlen is the length of the ESSID, 4096 is the number of times the information is hashed via SHA1, and 256 is the output key length. The PMK for ESSID "Linksys" is not the same as the PMK for ESSID "Cisco" even if the Nonces, MACs, and passphrases would be exactly the same. – Steel City Hacker Jan 7 at 13:36
@Steel City Hacker Yes, I'm aware of that, but I considered this to be details not very relevant for the question at hand. Thus I only provided the link, where those details are included. – hakoja Jan 7 at 14:06
1  
If i sniff the 4-way handshake and know PSK, then can i decrypt others connection? If yes, then Diffie-Hellman should have prevented this? I frequently share my PSK password with friends, and i didn't expect, that they could sniff my own traffic. – Michael Jan 7 at 14:55
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.