2010-04 802.11w

Beacon security in 802.11w
The conclusion: Give up!
– Beacons have no added security – However, protecting Action frames allows the network to secure frames like Neighbor Reports (802.11k) that have similar info
Confidentiality, Integrity, Replay, Source Authentication
Action Frames
Integrity, Replay
Confidential 2010
(Stolen from an IEEE presentation)
Intro to 802.11w (brown bag seminar)
Key Handshake Extensions
Or, how we get keys to stations to use for protection
KEY HANDSHAKE EXTENSIONS
Confidential 2010
Management Frame Protection Keys
Confidential 2010
Action frames (11k, 11y, 11v …)
– Contents of Action frames may cause specific STA actions
3 Confidential 2010
The start: Beacon security
Beacons are broadcast frames
2
Confidential 2010
Motivation: Untrustworthy mgt frames
No way of knowing what to trust Joining network
– Contents of Beacon frame may be important (e.g. QBSS load), but cannot be trusted without security
802.11w Introduction
Matthew Gast Brown Bag seminar, 14 April 2010
Confidential 2010
Agenda
Motivation & background for 11w Key handshake extensions Broadcast Integrity Protocol (BIP) Disconnect authentication Security Association liveness (SA-Query) Product implementation considerations
The idea of a MIC for management frames survived the process, and turned into 802.11w
9
Confidential 2010
802.11w Architecture
Overall architecture: Encrypt what you can, sign what you must
– Compute MIC over Beacon contents using a single shared key, and put MIC into Beacon – Discard Beacon if MIC cannot be verified
Problems
– Single shared key subject to insider forgery ( STA must know the key, and can forge anything) – Key distribution problematic for public networks – No replay protection for unassociated stations because they can’t validate the sequence number
Key distribution and the 4WHS
IGTK is encrypted in message 3 of 4WHS IGTK is distributed encrypted (along with RSN IE)
– Distributed to a single STA upon association
State 3 Management Frames Robust Management Frames
11r, 11k
Unicast Management Frames
Broadcast Management Frames
BIP CCMP
Look, no TKIP!
DeAuth, DisAssoc
Integrity, Replay
Leaving network
– “Get off my network” frames (Deauthenticate and Disassociate messages) are easily forged – depend only on AP MAC address – In fact, it’s a common protocol trick to make stations go away for security reasons
Problems
– No way to validate dynamic Beacon contents (e.g. QBSS load) – Stations need to commit to associating before they can validate the Beacon
8 Confidential 2010
Figure 8-34 from 802.11w-2009
14 Confidential 2010
The Easy Part: Unicast Protection
Or, we already know how to use CCMP, right?
KEY HANDSHAKE EXTENSIONS
5 Confidential 2010
Beacon security 2: PairwiseMICs
Create a Management MIC IE
– But every station has its own key – MIC IE holds n different MIC values, one per station in range – On receipt, each STA validates MIC with its own keys
Problems
– RSA private key operations are very expensive – Every change in protected Beacon parameters triggers signature requirement – Requires 64 bytes for signature plus 20 for hash? – Certificate distribution: how does the client get the CA cert?
Figure 8-33 from 802.11w-2009
13 Confidential 2010
Group Key Handshake, modified
Encrypted IGTK is re-distributed by group key handshake IGTK should be refreshed when a STA leaves the BSS
Problems
– You thought key distribution in method 1 was bad? Every (AP + station) pair needs its own key, every AP must maintain a key per station, and every station must maintain a key per AP – You think Beacons are bloated now? Each MIC will need at least 8 bytes per station, but you probably need to identify each MIC by address. (With headers, it’s probably more like 23 bytes per station) – How does an AP know when to start inserting a MIC for a particular STA that is investigating association?
Unicast: There is already a unicast key
– RSN (a.k.a. 802.11i) already distributes unicast keys – Header fields need to be validated, along with QoS field – no TKIP – Unicast frames like deauth&disassoc must come through CCMP
Integrity GTK
– New key defined by 802.11w for BIP to “sign” broadcast management frames – Shared by all STAs in BSS; allows insider attacks