By Jim Geier

August 28, 2003

Mutual authentication is a critical component of any network, especially a wireless LAN. The user should authenticate with the network, and the edge device, such as an access point or wireless router, should also authenticate with the user. This establishes trust among everyone and avoids the perils of man-in-the-middle attacks.

The original 802.11 standard, however, doesn’t specify a robust form of authentication. As a result, the designer of a wireless LAN must consider other methods of authentication. In this tutorial, we’ll focus on the Cisco proprietary Lightweight Extensible Authentication Protocol (LEAP).

802.11 Authentication Vulnerabilities

When a wireless client becomes active, it searches the medium for beacons that the access points broadcast. By default, the access point broadcasts beacons containing the service set identifier (SSID) of the access point, as well as other parameters. The access point only enables association if the SSID of the client matches the SSID of the access point. This process offers a basic but very weak form of authentication.

Of course the major vulnerability is the fact that the SSID is sent in the clear (unencrypted), which makes it visible to wireless packet sniffers (e.g., Airmagnet and Airopeek). Because of this, a hacker can easily identify the SSID within the beacon frame and authenticate with the wireless LAN. Even if the access point is set to not broadcast the SSID (a feature available in only a few access points), sniffers can still obtain the SSID from association request frames sent from clients to the access point.

802.11 offers by default a form of authentication called open systems authentication.In this mode, the access point grants approval for any request for authentication. The client simply sends an authentication request frame, and the access point responds with an authentication approval. This lets anyone having the correct SSID to associate with the access point.

The 802.11 standard also includes an optional, more advanced form of authentication referred to as shared key authentication. This is a four step process. The client sends an authentication request frame, and the access point responds with a frame containing a string of characters called challenge text.

The client then encrypts the challenge text using the common wired equivalent privacy (WEP) encryption key. The client sends the encrypted challenge text back to the access point, which decrypts the text using the common key and compares the result with the text originally sent. If the decrypted text matches, then the access point authenticates the client.

This seems adequate for authentication, but a problem is that shared key authentication only proves that the client has the correct WEP key. The weaknesses of WEP make Man-in-the-Middle attacks possible. Through this type of attack, a hacker can capture the original challenge packet as well as the WEP encrypted challenge packet. From these two packets and the use of commonly available tools, a hacker can easily mimic an authorized using and authenticate with the access point.

As a result, standard 802.11 authentication mechanisms don’t provide adequate levels of protection. Of course another issue is that 802.11 authentication mechanisms do not authentication the access point to the client.

LEAP to the Rescue?

Cisco’s LEAP wireless authentication process helps eliminate security vulnerabilities by supporting centralized, user-based authentication and the ability to generate dynamic WEP keys. Cisco LEAP is one of the extensible authentication protocol (EAP) types specified by 802.1X.

LEAP is easy to implement and contains compelling features such as:

• Mutual Authentication. In wired networks, there is a direct physical connection between the client and device, therefore the client is relatively sure that it is communicating with the right network. That is not the case, however, in a wireless LAN. Because there is no physical connection between the two, the client must authenticate the network and the network needs to authenticate the client, hence mutual authentication.
• User-Based Authentication. Traditional802.11 authentication only verifies radio devices, not actual users. Because of this, it is very easy for an unauthorized user to access the network through a preauthorized piece of equipment, for instance an employee’s laptop. LEAP eliminates this by authenticating the user through usernames and passwords, rather than just the device.
• Dynamic WEP Keys. Cisco LEAP uses 802.1X to continually generate unique WEP keys for each user. Every 802.1X session timeout forces clients to re-associate to the network, which is when the new WEP keys are generated. The re-associations are not noticeable by users and are very important to keep all sensitive data constantly encrypted.

Cisco is freely licensing its wireless LAN security suite, which includes LEAP, to many chipset and radio card manufacturers. Many feel this move might undercut the work of the 802.11i working group efforts. Because not all 802.11 products support LEAP, though, you run into interoperability issues in a mixed vendor environment (e.g., public wireless LANs).

If you are sure that all products on the network will support LEAP — for example, a Cisco-only network — LEAP is a viable security measure. In cases where there are multiple client device vendors, consider another form of authentication.

What are the Alternatives?

Similar to LEAP, Wi-Fi Protected Access (WPA) also securely authenticates wireless users to the network. There are a couple of differences between the two, however. WPA specifies Temporal Key Integrity Protocol (TKIP) for distributing dynamic encryption keys and then lets the client use the EAP type of their choice. In WPA these two functions are separate from each other.

Cisco uses a proprietary version of TKIP that is not interoperable with WPA. Cisco is addressing the problem of interoperability with WPA, however. An updated version will provide support for WPA.

Because of the common implementation of WPA in nearly all Wi-Fi products, WPA is a better choice in most situations having a mixed vendor environment. In addition, WPA is actually a subset of 802.11i, which makes WPA somewhat of a better long term, interoperable solution.

• Author
• Recent Posts

Jim Geier

Jim Geier is an independent consultant and author with 30 years experience planning, designing, analyzing and implementing communications systems, wireless networks, and mobile devices. Jim is the author of over a dozen books on mobile and wireless topics, such as including Designing and Deploying 802.11ac Wireless Networks (Cisco Press), Implementing 802.1X Security Solutions (Wiley), Wireless Networking Handbook (New Riders) and Network Re-engineering (McGraw-Hill). He has been an active participant within IEEE standards organizations, such as the IEEE 802.11 Working Group, and the Wi-Fi Alliance. He has served as Chairman of the IEEE Computer Society, Dayton Section, and various conferences. He has served as a testifying expert for patent litigation cases focusing on technologies dealing with Wi-Fi, Bluetooth, mobile devices, cellular systems, wireless network protocols, network security mechanisms, location systems, and application data management protocols. Jim’s education includes bachelor’s and master’s degrees in electrical engineering, with emphasis in mobile devices / systems and wireless communications.

Latest posts by Jim Geier (see all)

• Minimize WLAN Interference - October 19, 2021
• Determining WLAN Capacity - October 15, 2021
• How to: Sniff Wireless Packets with WireShark - October 15, 2021