Cyberstudy
PDF p.250 In progress

Wi-Fi Authentication Methods

Open PDF at p.250 19 flashcards

Summary

PDF p.250

Wi-Fi authentication ensures that only valid users connect to the network. It includes personal, open, and enterprise methods, with personal methods like pre-shared key (PSK) and simultaneous authentication of equals (SAE).

In plain words

Supplementary — not from your PDF

Personal Wi-Fi uses one shared secret. WPA2-PSK turns the passphrase into a key with PBKDF2 and a 4-way handshake, so a short passphrase can be guessed offline; use 14 or more characters. WPA3-SAE uses the Dragonfly handshake, which resists offline guessing and gives forward secrecy. Enterprise Wi-Fi uses 802.1X with RADIUS, giving each user or device its own credentials through EAP methods such as EAP-TLS (certificates on both sides), PEAP or EAP-TTLS (server certificate).

Detailed explanation

PDF p.250
  • Personal Authentication
    • WPA2-PSK: Uses a passphrase to generate a key for encrypting communications. Vulnerable to dictionary and brute force attacks.
    • WPA3-SAE: Uses Password-Authenticated Key Exchange (PAKE) for secure key agreement, providing better protection against offline attacks.
  • Enterprise Authentication
    • 802.1x Authentication: Uses unique credentials for each user/device, verified by a RADIUS server. Supports multiple EAP types for secure authentication.

WPA2 Pre-Shared Key (PSK) Authentication

  • Passphrase: 8-63 ASCII characters, converted to a 256-bit HMAC (PMK) using PBKDF2.
  • 4-Way Handshake: Uses PMK to derive session keys.
  • Vulnerabilities: Susceptible to dictionary and brute force attacks; passphrase should be at least 14 characters long.

WPA3 Personal Authentication

  • SAE Protocol: Replaces PSK, uses Dragonfly handshake (Diffie-Hellman over elliptic curves) for secure key exchange.
  • Forward Secrecy: Ephemeral session keys prevent offline attacks.
  • Configuration Labels: May be labeled as WPA2-Personal, WPA3-SAE, etc.

Advanced Authentication

  • 802.1x Authentication: Port-based network access control, typically using RADIUS servers.
  • Unique Credentials: Each user/device has unique credentials, enhancing security and tracking.
  • EAP Types: EAP-TLS (client-server certificates), EAP-TTLS, PEAP (server-side certificates).

RADIUS Authentication Workflow

  • 1. Connection: User's device (supplicant) connects to NAS (e.g., access point).
  • 2. Credential Prompt: NAS prompts for authentication credentials.
  • 3. Access-Request: NAS sends encrypted Access-Request to AAA server.
  • 4. Decryption: AAA server decrypts request using shared secret.
  • 5. EAP Exchange: Access-Challenge and Access-Request packets exchanged for verification.
  • 6. Access-Accept/Reject: AAA server responds with Access-Accept or Access-Reject.
  • 7. Accounting (Optional): NAS logs usage data to accounting server.

Important terms

taken from the text above
WPA2-PSK
Uses a passphrase to generate a key for encrypting communications. Vulnerable to dictionary and brute force attacks.
WPA3-SAE
Uses Password-Authenticated Key Exchange (PAKE) for secure key agreement, providing better protection against offline attacks.
802.1x Authentication
Uses unique credentials for each user/device, verified by a RADIUS server. Supports multiple EAP types for secure authentication.
Passphrase
8-63 ASCII characters, converted to a 256-bit HMAC (PMK) using PBKDF2.
4-Way Handshake
Uses PMK to derive session keys.
SAE Protocol
Replaces PSK, uses Dragonfly handshake (Diffie-Hellman over elliptic curves) for secure key exchange.
Forward Secrecy
Ephemeral session keys prevent offline attacks.
Configuration Labels
May be labeled as WPA2-Personal, WPA3-SAE, etc.
Unique Credentials
Each user/device has unique credentials, enhancing security and tracking.
EAP Types
EAP-TLS (client-server certificates), EAP-TTLS, PEAP (server-side certificates).
Connection
User's device (supplicant) connects to NAS (e.g., access point).
Credential Prompt
NAS prompts for authentication credentials.
Access-Request
NAS sends encrypted Access-Request to AAA server.
Decryption
AAA server decrypts request using shared secret.
EAP Exchange
Access-Challenge and Access-Request packets exchanged for verification.
Access-Accept/Reject
AAA server responds with Access-Accept or Access-Reject.
Accounting (Optional)
NAS logs usage data to accounting server.
PSK Pre-Shared Key PAKE Password-Authenticated Key Exchange

Examples & real-world scenarios

Supplementary — not from your PDF
  • A long random WPA2 passphrase on a home network.
  • Corporate Wi-Fi using EAP-TLS with device certificates.
  • RADIUS logging which user connected to which AP.

Scenario

A company shares one Wi-Fi password among 200 staff. When someone leaves, the password must change for everyone. Moving to 802.1X gives each person their own credentials, which can be revoked individually.

Common mistakes

Supplementary — not from your PDF
  • Using a short dictionary word as a PSK.
  • Mixing up EAP-TLS (client and server certificates) and PEAP (server certificate only).

Practical skills

Supplementary — not from your PDF
  • Recommend personal or enterprise Wi-Fi authentication.
  • Put the RADIUS authentication steps in order.

What I should remember

Key Points PDF p.250

The PDF has no Key Points for this subsection. Use the Summary and Detailed Explanation above.