1. Home
  2. Wireless Networking
  3. ALERT: WPA isn't necessarily secure

ALERT: WPA isn't necessarily secure

SUMMARY:

WPA-PSK is vulnerable to offline attack.

TO AVOID THE PROBLEM:

USE A PASSPHRASE WITH MORE THAN 20 CHARACTERS. Examples: BAD: "vintage wine" GOOD: "floor hiking dirt ocean" (pick your own words, even longer is better) FOR HIGH SECURITY, USE MORE THAN 32 CHARACTERS.

BACKGROUND:

Weakness in Passphrase Choice in WPA Interface By Glenn Fleishman By Robert Moskowitz Senior Technical Director ICSA Labs, a division of TruSecure Corp

... The offline PSK dictionary attack ... Just about any 8-character string a user may select will be in the dictionary. As the standard states, passphrases longer than 20 characters are needed to start deterring attacks. This is considerably longer than most people will be willing to use.

This offline attack should be easier to execute than the WEP attacks. ... Using Random values for the PSK

The PSK MAY be a 256-bit (64 hexadecimal) random number. This is a large number for human entry; 20 character passphrases are considered too long for entry. Given the nature of the attack against the 4-Way Handshake, a PSK with only 128 bits of security is really sufficient, and in fact against current brute-strength attacks, 96 bits SHOULD be adequate. This is still larger than a large passphrase ... ... Summary ... Pre-Shared Keying is provided in the standard to simplify deployments in small, low risk, networks. The risk of using PSKs against internal attacks is almost as bad as WEP. The risk of using passphrase based PSKs against external attacks is greater than using WEP. Thus the only value PSK has is if only truly random keys are used, or for deploy testing of basic WPA or 802.11i functions. PSK should ONLY be used if this is fully understood by the deployers.

See also: Passphrase Flaw Exposed in WPA Wireless Security

Wi-Fi Protected Access. Security in pre-shared key mode

Cracking Wi-Fi Protected Access (WPA)

WPA Cracker

Reply to
John Navas
Loading thread data ...

This is too inflammatory. I can think of lots of 8-character 7-bit ASCII strings that may be memorable to a user but not be a word in the dictionary--almost any involving any numerals or punctuation marks come to mind.

Steve

Reply to
Steve Fenwick

Why does your key have to be "memorable"? It's not as if you have to enter it very often.

I made mine by opening a text editor and randomly pounding on the keyboard, making sure to hit the shift key from time to time and get all the rows.

I keep the generated key on a CD in my office, and use a USB memory stick to propagate it to my 2 laptops when the need arrises.

Reply to
Bert Hyman

Certainly, although I occasionally have to give it to someone else, so not having to look up the plaintext of it is useful. YMMV.

The examples given in the original all seemed to be phrases (or at least combinations of words) that a user could remember.

Steve

Reply to
Steve Fenwick

I've never had occasion to do that, but if I did, I'd change the key as soon as they were done with their visit.

So, one less thing to have to memorize, which gets to be an iffy thing at my age :-)

Reply to
Bert Hyman

It does bring up an interesting point, if the passphrase is a word in the dictionary.

WPA-PSK is not secure that way.

When I set up a wireless network for a client, I usually choose a word from the surroundings, books, videos, one that has 10-12 letters in it.

Then I add a random number after each letter. Very hard for a password guessing program to guess.

Justin

Reply to
Justin Alexander

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.