A survey of security weaknesses in IEEE 802.11

Carl Fredrik Eckardt, Jonathan Michael Baird

IEEE 802.11 is a standard for wireless networking. Over the years there have been several criticisms laid forward in regards to the security weaknesses of the algorithms used for encryption. This document aims to provide an overview of the standard, with focus on these weaknesses. WEP is considered weak as the encryption can be broken in seconds given that an attacker has listened to the encrypted traffic long enough. WEP was deprecated in 2003 and replaced by WPA. WPA is not known to be algorithmically weak but it is still susceptible to brute force attacks when employed with weak pass phrases.

This document is available in pdf.

Our matriculation numbers are NT070158H and NT070065W respectively.

Contents

1  List of abbreviations
2  Preface
    2.1  About the document
        2.1.1  Notation
3  Introduction
    3.1  Topics covered
4  WEP
    4.1  Description
5  WPA
    5.1  Description
    5.2  The WPA-PSK handshake
        5.2.1  TKIP
        5.2.2  RADIUS
        5.2.3  CCMP
6  Attacks on WEP and WPA
    6.1  WEP
    6.2  WPA
7  Circumvention of problems and remedies
8  Software
A  RC4
    A.1  Description of the ARC4 algorithm
    A.2  Obtaining the key from a set of keystreams
B  AES/Rijndael
    B.1  Description of 128-bit Rijndael (AES)
C  ARP-requests and responses for WEP-hacking
D  Sources