Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

The WLAN's Weakest Link

Talk About an Oxymoron

Discuss Join other NWC readers in discussing this article.

Throughout the process, the 802.11i Task Group remained painfully aware that the transition from old station hardware would be slow because of the installed base of wireless networking cards that conform to the Wi-Fi standard. RSN does provide for both RC4 and AES encryption, though it will take new Wi-Fi adapters or fast stations to support the AES encryption. But the principal concession to the RSN migration effort is the inclusion of Transition Security Network (TSN), which is defined only to facilitate migration to an RSN, according to the standard. "A TSN is insecure, since the pre-RSN equipment can compromise the larger network," the standard says. The contradiction of an insecure security network comes from the ways broadcast and multicast traffic are (and aren't) protected and from the inclusion of preshared (manually configured) keys in RSN.

An access point sends broadcast and multicast frames encrypted with the weakest configured security method: WEP (Wired Equivalent Privacy), TKIP (RSN with RC4) or CCMP (RSN with AES). If the AP is configured for TSN, the WEP-encrypted broadcast frames will easily yield the WEP key, exposing all broadcast traffic even if no associated station is using WEP. And if RSN is being deployed with preshared keys because setting up RADIUS and choosing a trustworthy authentication method are too difficult, chances are the same key is being used for WEP and preshared-key RSN! So much for robust security.

Sure, every security system has its weakest link. And RSN does address all three aspects of a security system--authentication, key distribution and data confidentiality. But it provides only legacy approaches to them all, and the legacy 802.11 Wi-Fi standard has shared keys for authentication; it has no key distribution and only weak data confidentiality. Using any of these legacy features in an RSN leaves the network compromised.

He Who Hesitates ...

  • 1