Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network Security > Security in Wireless Networks > Flashcards

Security in Wireless Networks Flashcards

1
Q

What is attractive most about wireless?

A

CAMP
Installation flexibility, speed, and scalability
Regions without or with limited wired infrastructure can easily establish wireless communication
Better chance of surviving disasters
802.11 wireless LANs, WiMAX, and 3G+ cellular networks promise high bandwidths, global mobility, quality of service, and seamless integration with one another

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the current wireless LAN standard?

A

802.11

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a station?

A

All components that can connect to the wireless medium in an 802.11 WLAN are called stations

  • Wireless clients or Access points are stations
  • All stations are equipped with wireless network interface cards
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a BSS

A

The basic building block of an 802.11 WLAN is called a basic service set (BSS).
It is a set of stations that can communicate with each other.
BSSs can be set up in one of two ways:
– Independent BSS: No access points. Also called ad hoc networks
– Infrastructure BSS: Access points serve as base stations for receiving and broadcasting messages

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Describe an infrastructure BSS

A
  • Stations communicate via an AP
  • A set of infrastructure BSSs connected together in a network is referred to as an extended service set (ESS)
  • Traffic within the BSS and also from one BSS to another is via the APs
  • The APs in an ESS are connected by a distribution system which facilitates communication among the APs
  • The distribution system is typically a wired LAN
  • Two significatn addresses: BSS ID (MAC address of the AP serving the BSS), and ESS ID (Character string assigned by the admin, also called the SSID)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What kinds of security are in 802.11 WLANs?

A

Basic level security (SSID + MAC address filtering)
Medium level security (WEP)
High level security (WPA1, WPA2, 802.11i Security Standard, Wireless VPNs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe basic level security in WLANs

A

SSID:

  • SSID is a character string programmed in the APs serving the WLAN
  • It is a rudimentary authentication value, every wireless client must know the SSID in order to get connected to the WLAN
  • Access points periodically broadcast SSIDs in clear text.
  • If the broadcast feature is turned off, then only clients which know the SSID can get connected

MAC Address Filters:

  • Access points can be programmed to accept authentication requests only from wireless clients with legitimate MAC addresses
  • Work similarly to access control lists but at the MAC layer
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the weaknesses in Basic Level Security in WLANs?

A
  • SSIDs are broadcast in plaintext
  • Even if the broadcast feature is turned off, an active sniffer can extract SSID from an AP
  • MAC address spoofing can penetrate MAC address filter
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Describe medium level security in WLANs

A

WEP (Wired Equivalent Privacy)

  • proposed to provide link-level security in 802.11 networks.
  • intended security goals were confidentiality, access-control, integrity and authentication
  • Uses a shared key for encrypting and authenticating data between a client and access point
  • one of the four shared keys can be manually configured in the AP, and the wireless clients
  • Some wireless cards rotate the key used among the four keys periodically
  • key sizes 40 bits or 104 bits
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Describe WEP encryption

A
  • a 40-bit or 104-bit secret key is concatenated with a 24-bit initialization vector (IV) to give a 64-bit or 128-bit WEP key
  • the WEP key is input to a pseudo-random number generator based on RC4 algo to produce a key stream
  • An integrity check value (ICV) based on CRC is computed for the plaintext
  • The plaintext concatenated with the ICV is XORed with the key stream to generate the ciphertext
  • the transmitted message consists of IV and the cipher text
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Describe WEP Decryption

A
  • the secret key is concatenated with the IV to get back the 64-bit or 128-bit WEP key
  • the WEP key is input to the same pseudo-random number generator algorithm to produce the same key stream
  • The ciphertext is XORed with the key stream to get back the plaintext and the ICV
  • An integrity check value ICV is independently computed and checked against the received ICV
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Describe WEP Authentication

A
  • the wireless client sends an authentication request to the access point
  • the access point sends a random challenge text in clear
  • the client encrypts the challenge text using the secret key and sends it back to the access point
  • The access point authenticates the client by decrypting the challenge response
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the (7) weaknesses in WEP?

A

1 - shared static key
2 - IV is sent in plaintext
3 - size of the IV is only 24 bits (so IVs are repeated)
4 - Use of CRC for authentication and integrity
5 - the authentication handshake reveals a PT-CT pair
6 - One way authentication
7 - Management frames not protected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Wi-Fi protected access version 1 (WPA 1)

A
  • Designed to remove WEPs weaknesses and also to add a stronger authentication feature compared to WEP
  • Consists of two main components (authentication and key management 802.1x, and TKIP - encryption and integrity)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Describe the features of TKIP (Temporal Key Integrity Protocol)

A
  • Per packet key mixing: change the encryption and authentication keys for every frame
  • Stronger integrity check algorithm: algorithm MIC based on HMAC is used
  • Sequence numbers are added to frame fragments
  • Increased IV size: IV size is increased to 48 bits (from 24 bits) this avoids IV reuse
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Describe the TKIP process

A
  • Two keys derived from the master key are used as input keys: a 128-bit encryption key and a 64-bit data integrity key
  • Phase 1 key mixing generates an intermediate key from the encryption key and the sender’s MAC address
  • MIC generates the payload plus the message digest from the data integrity key, sender and receiver’s MAC addresses and the payload
  • Payload plus digest is fragmented and each fragment is assigned a sequence number
  • Phase 2 key mixing uses the intermediate key and the sequence number to generate a per packet key (for each fragment)
  • The per-packet key and the fragment undergo the regular WEP encapsulation process to produce the ciphertext
17
Q

What is 802.1X

A

802.1X is a protocol for authenticating wireless nodes and also for generating keys

18
Q

Describe the 802.1X process

A
  • When a new wireless client requests access to the WLAN the access point asks for the indentity of the client and issues a temporary encryption key
  • The client sends the user name and password to the authenticator
  • The authenticator relays it to an authentication server using another secret key encryption
  • The authentication server verifies the client’s credentials and sends a permit message if the verification is successful. It also issues keys for TKIP
19
Q

What are the weaknesses of 802.1X?

A
  • One way authentication

- Management frames are not protected

20
Q

What is Wi-Fi Access Version 2 (WPA 2) or 802.11i

A
  • improved version of WPA (June 2004)
  • Provides an alternative encryption algorithm based on EAS called CCMP (cipher block chaining mode message authentication code protocol)
  • 802.1X has been extended to provide bi-directional authentication between the client and the access point

Weakness: management frames are still in the open

Network Security (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions