NSRI

1

김 춘 수

NSRI

jbr@etri.re.kr

무선랜 보안 솔루션

NSRI

2

Agenda

• WLAN 개요

• WLAN 보안 취약점

– WEP

– 802.1x

– Summary

• WLAN 보안 Solutions

– TKIP

– Inner VPN

– Vendor

– Summary

NSRI

3

WLAN 개요

NSRI

4

Wireless LAN(1)

• IEEE 802.11 – 802.11, 802.11b, 802.11a, 802.11g

– IR(Infrared)

– SS(Spread Spectrum) • FHSS(Frequency Hopping SS)

• DSSS(Direct Sequence SS)

• OFDM(Orthogonal Frequency Modulation)

• WATM-WG(ATM Forum)

• SUPERLAN(WIN Forum)

• ETSI – HIPERLAN1

– HIPERLAN2

• Bluetooth

• MMAC-PC(Multimedia Mobile Access Communication)

• Home RF

NSRI

5

Wireless LANs(2)

Characteristics 802.11 802.11b 802.11a(g) HIPERLAN1/2

Modulation FHSS/DSSS(IR) DSSS OFDM OFDM

Carrier Freq. 2.4GHz 2.4GHz 5GHz(2.4) 5GHz

Max. Physical Rate 2Mbps 11Mbps 54Mbps(22) 54Mbps

Max. Data Rate(Layer 3) 1.2Mbps 5Mbps 32Mbps 32Mbps

MAC/Media Sharing CSMA/CA CSMA/CA CSMA/CA Central Resource Control/TDMA/TDD

Connectivity Connectionless Connectionless Connectionless Connection Oriented

Authentication No No No NAI/IEEE Addr./X.59

Encryption 40bit RC4 40bit RC4 40bit RC4 DES/T-DES

Fixed Network Support Ethernet Ethernet Ethernet Ethernet, IP, ATM, UMTS, PPP

Radio Link Quality Control No No No Link Adatation

NSRI

6

Wireless Network Architecture

Distribution System

AP (a)

Station (a1)

Server

Station (a2)

AP (b)

Station (b1)

Station (b2)

Ad-hoc

Station (ah1)

Station (ah2)

NSRI

7

Ad-Hoc Network

• No structure to the network

• No fixed points

• Communicate to every nodes

• Packet transmission order

Mobile Station

Mobile Station

Mobile Station

Mobile Station

Ad-HOC Network

NSRI

8

Ad-hoc Network(Bluetooth)

적용 방식

P2P Connection Multipoint Connection Personal Connected Bubble

활용 시기

2001 ~ 2003 ~ 2005 ~

상용 시스템

NSRI

9

Ad-hoc Network(HIPERLAN)

F F F

NF

NF NF

NF F : Forwarder NF : Non-Forwarder

NSRI

10

Infrastructure Network

• Fixed network access point

• Similar to cellular networks

NSRI

11

WLAN 보안 취약점

WEP

NSRI

12

무선 LAN 보안 기술

• 무선 LAN 위협

– 데이터 측면

• 서비스 이용자 : 같은 Hot Spot 지역에 위치한 다른 사용자들에게 자

신의 검색중의 정보 그대로 유출

– 네트워크 측면

• 동일 Hot Spot 지역에서 동일 AP를 통해 동시에 인터넷 접속 타인의

컴퓨터 환경 검색 가능

• 무선 LAN의 보안

– 데이터 보안 측면

• 스니퍼등을 통해서 무선랜 데이터 내용 자체를 몰래보는 행위를 방어

– 네트워크 보안 측면

• 승인된 사용자에게만 네트워크 접속을 허용

NSRI

13

무선 LAN 보안 기술

• 무선 LAN 국제 표준 IEEE 802.11 토대

• 무선 LAN에서의 AP와 단말간의 인증 및 암호화

• 무선 LAN의 MAC 계층에서 구현

• 상위계층에서의 보안은 응용에 따라 별도 구성

NSRI

14

무선 LAN 보안 기술

• 무선랜에서의 인증 방법

– SSID(Service Set ID)를 이용한 인증방법

– Open System 인증 방법

– Shared WEP Key 인증 방법

– EAP(Extensible Authentication Protocol) 인증 방법 (IEEE 802.1x)

– VPN (Virtual Private Network) 인증방법

• 무선랜에서의 암호 기법

– WEP : RC4 사용, 40비트

– WEP 2 : RC4 사용, 128비트

– TKIP : AES 128bit 블럭암호

NSRI

15

무선 LAN 인증 기법(#1)

• SSID를 이용한 인증

– 가장 간단한 방법(단순한 Text 형태로 전송)

– 인증방법이라기 보다는 네트워크 선택방법

SSIDa SSIDb

SSIDa

NSRI

16

무선 LAN 인증 기법(#2)

• Open System 인증 방법

– 무선랜 카드가 소유한 48비트 MAC 주소 이용

– 특정 MAC 주소 소유자만 접속 가능

– AP가 MAC 주소 리스트 보유

– 이동성이 없음

Authentication Request(Sqe #1)

Authentication Result(Sqe #1)

NSRI

17

무선 LAN 인증기법(#3)

• Shared WEP Key 공유 키 인증

– 공통적으로 가지고 있는 WEP 키 사용

– Challenge를 암호화한 결과값이 평문으로 전송

– Replay Attack에 대응방안 없음

Authentication Request(Sqe #1)

Authentication challenge(Sqe #2)

Authentication Response(Sqe #3)

Authentication Result (Sqe #4)

NSRI

18

WEP(Wired Equivalent Privacy)

• WEP의 개요

– 유선망과 동일한 수준의 비밀성을 제공하기 위한 Link Layer의

보안프로토콜

– IEEE 802.11에서 제안

– Prevent link-layer eavesdropping

– As secondary role WEP controls network access

– Uses RC4 stream cipher of RSA Data Security for encryption

– Key must shared by both the AP and stations

– Several vendors use 104bits keys

– Only a few have implemented WEP in H/W

– The MAC address are sent in the clear

– Key distribution/negotiation is not mentioned in the standard

NSRI

19

WEP(암복호화 과정)

Conc

Conc

Integrity Algorithm

PRNG Xor

WEP PRNG

Integrity Algorithm

ICV'=ICV

Mux

Xor

IV IV

k C

IV

k

C

P

P

WEP

ICV'

IV=24 bit, k=40 bit

IV(Initial Vector), ICV(Integrity Check Value)

NSRI

20

WEP(프레임 구조)

IV Plain Text ICV

RC4 encrypted

Message(Plain Text)

CRC

Keystream=RC4(iv,k)

XOR

ICV(Integrity Check Value)

NSRI

21

WEP Keys(802.11)

Header:Key3 EKey3(Data) Trailer

Header:Key1 EKey1(Data) Trailer

Key1:4329…

Key2:5346…

Key3:1064…

Key4:4590…

Key1:4329…

Key2:5346…

Key3:1064…

Key4:4590…

IV Message ICV

0~2304Byte 4Byte

IV Pad Key ID

24Bit 6Bit 2Bit

NSRI

22

WEP의 취약점(요약)

• The 802.11 standard does not specify how distribution of keys is to be accomplished.

• In practice, most installations use a single key

• Message Authentication : CRC-32 checksum

• www.isaac.cs.berkeley.edu/isaac/wep-faq.html (UC Berkeley) – Stateless Protocol : Key Stream Reuse

– Linear Checksum : integrity check

– IV reuse : IV space – 224 possibilities, Collision every 4s

– Encryption Oracle : Attack from Both Ends

– WEP Key Stored on the NIC

• WEP should not be counted on to provide strong link-level security end-to-end encryption Needed

NSRI

23

WEP의 취약점(IV Reused, Collision)

• 키수열 생성시 k, IV를 사용

• 키 수열 = RC4(k,IV)

• 암호문( C) = 키수열 xor 평문(P)

• 동일한 키 수열 사용 가능

• IV 선택에 대한 방법이 제시되어 있지 않음

– 일부 경우 IV는 초기화때마다 0으로 setting되며 매 패킷마다 1씩 증가

– 예) 11Mbps, 패킷당 1,500바이트 전송 경우 :

Collision : 1,500 * 8/( 11*10^6) * 2^24 = 18,000초 = 5시간

NSRI

24

WEP의 취약점(Linear Checsum)

• 메세지 변조 가능

– 무결성을 위하여 32비트 CRC checksum 기법 사용

– CRC는 Random 에러 검증용이며, 선형(linear) • 공격자는 A B로 송신하는 암호문 C와 IV값 획득

A (B) : (IV,C)

C = RC4(IV,k) (M||c(M))

• M’ = M 에 상응하는 C’ 생성(은 공격자에 의해 선정)

• 암호문( C ) 대신에 변조된 암호문(C’)을 B에게 전송

• B가 올바른 checksum을 가지고 변조된 평문(M’)을 수신하게 만듬

(A) B : (IV, C’)

• C’ = C (,c())라 하면, CRC는 선형이므로

C’ = C (,c( )) = RC4(IV,k) (M,c(M)) (,c( ))

= RC4(IV,k) ( M , c(M) c() )

= RC4(IV,k) ( M’, c(M ))

= RC4(IV,k) ( M’, c(M’))

NSRI

25

WEP의 취약점(Replay)

• Once sniffed, a WEP encrypted frame can be replayed again and again by an attacker

• This replayed frame will be decrypted and processed by STA & AP as the original one

• Specifically dangerous for stateless potocols(UDP:NFS,NTP….)

• Not only the original frame can be replayed, but it can be modified as well

NSRI

26

Leaking the WEP key

NSRI

27

IP Sec vs. 802.11

NSRI

28

WLAN 보안 취약점

802.1x

NSRI

29

IEEE 802.1x(1)

• Introduction

– Provide a means of authenticating and authorizing devices attached to a LAN port

– Provides an architectural framework on top of which one can use various authentication methods

• Purpose

– Specifies a protocol between devices desiring access to the bridged LAN and devices providing access to the bridged LAN.

– Specifies the requirements for a protocol between the Authenticator and an Authentication server (e.g. RADIUS).

– Specifies different levels of access control and the behavior of the port providing access to the bridged LAN.

– Specifies management operations via SNMP.

NSRI

30

802.1x(2)

• What 802.1X is not

– Purely a wireless standard – it applies to all IEEE 802 technologies (e.g. Ethernet First Mile applications)

– PPP over Ethernet (PPPOE) – only supports EAP authentication methods (no PAP or CHAP), packets are not encapsulated

– A cipher – not a substitute for WEP, RC4, DES, 3DES, AES, etc.

• But 802.1X can be used to derive keys for any cipher

– A single authentication method

• But 802.1X can support many authentication methods without changes to the AP or NIC firmware

NSRI

31

Definitions

• Authenticator

– The entity that requires the entity on the other end of the link to be authenticated.

• Supplicant

– The entity being authenticated by the Authenticator and desiring access to the services of the Authenticator.

• Port Access Entity (PAE)

– The Protocol entity associated with a port.May support functionality of Authenticator , Supplicant or both

• Authentication Server

– An entity providing authentication service to the Authenticator.Maybe co-located with Authenticator, but most likely an external server.

NSRI

32

802.1X Topologies

Authenticator/EtherNAS (e.g. Access Point or

Bridge)

Supplicant

Enterprise or ISP Network

Semi-Public Network / Enterprise Edge

AuthenticationServer

RADIUS

PAE

PAE

EtherCPE

Supplicant Non-802.1X

NSRI

33

EAP

• The Extensible Authentication Protocol (RFC 2284) – General protocol supporting multiple authentication methods – Provides a flexible link layer security framework – Simple encapsulation protocol – Few link layer assumptions

• Can run over any link layer (PPP, 802, etc.) • Does not assume physically secure link

– Methods provide security services

• Assumes no re-ordering • Can run over lossy or lossless media

– Retransmission responsibility of authenticator (not needed for 802.1X or 802.11)

• EAP methods based on IETF standards – Transport Level Security (TLS) (supported in Windows 2000) – Secure Remote Password (SRP) – GSS_API (including Kerberos)

NSRI

34

Ethernet Client

Switch

Radius Server

IEEE 802.1X Conversation

EAPOL-Start

EAP-Response/Identity

Radius-Access-Challenge

EAP-Response (credentials)

Access blocked

Port connect

Radius-Access-Accept

EAP-Request/Identity

EAP-Request

Access allowed

EAP-Success

Radius-Access-Request

Radius-Access-Request

RADIUS EAPOL

NSRI

35

Ethernet

Access Point

Radius Server

802.1X On 802.11

EAPOW-Start

EAP-Response/Identity

EAP Request (TLS Start)

EAP-Response(TLSClient_hello)

Access blocked

Association

EAP Success(TLS Session Key)

EAP-Request/Identity

EAP-Request(TLS Start)

EAP Response/Identity

EAP Response(TLS Client _Hello)

RADIUS

EAPOW

Station

Wireless

802.11 802.11 Associate-Request

EAP-Success (TLS Session Key)

Network AccessEnabled EAPOW-Key (WEP)

802.11 Associate-Response

WEP set in PC Card via NDIS OIDs

NSRI

36

802.1X authentication in 802.11

• IEEE 802.1X authentication occurs after 802.11 association or reassociation

– Association/Reassociation serves as “port up” within 802.1X state machine

– Prior to authentication, access point filters all non-802.1X traffic from client

– If 802.1X authentication succeeds, access point removes the filter

• 802.1X messages sent to destination MAC address

– Client, Access Point MAC addresses known after 802.11 association

• No need to use 802.1X multicast MAC address in EAP-Start, EAP-Request/Identity messages

– Prior to 802.1X authentication, access point only accepts packets with source = Client and Ethertype = EAPOL

NSRI

37

Advantages of IEEE 802.1X

• Open standards based

– Leverages existing standards: EAP (RFC 2284), RADIUS (RFC 2865, 2866, 2867, 2868, 2869)

– Enables interoperable user identification, centralized authentication, key management

– Enables automated provisioning of LAN connectivity

• User-based identification

– Identification based on Network Access Identifier (RFC 2486) enables support for roaming access in public spaces (RFC 2607).

– Enables a new class of wireless Internet Access

• Dynamic key management

– Improved security for wireless (802.11) installations

NSRI

38

Vulnerabilities of 802.1x

• Absence of Mutual Authentication

– Perform only a one-way authentication

– Expose the supplicant to potential Man–in-Middle attack

• The Man-IN-Middle setup for the attack

Typically 802.3

Supplicant

AP Authentication

server

802.11

802.11

NSRI

39

Vulnerability of 802.1x

• EAP Success Message MIM Attack

– Unconditional transfer to the Authenticated state irrespective of the current state,

– Cause the interface to provide network connectivity

– Adversary can get all network traffic from the supplicant

NSRI

40

Vulnerability of 802.1x

• Session Hijacking

EAP Request

EAP Response

EAP Success

Access Point Legitimate Supplicant

Supplicant Authenticated

802.11 MAC Disassociate Adversary spoofs

APs MAC address

Network Traffic

Adversary

NSRI

41

Proposed Solutions

• Per-packet authenticity and integrity

– Session hijack attack

• Lack of authenticity in management frame

– Add of integrity of data frame

• When Confidentiality is used

• Authenticity and Integrity of EAPOL messages

– Mim attack : The lack of authenticity of 802.1x messages

NSRI

42

Vendors Supporting 802.1X

• Microsoft, AirWave, Compaq, Dell, IBM, Intel, HP, Symbol, Toshiba, Telson, Wayport – http://www.microsoft.com/presspass/press/2001/Mar01/03-

26XPWirelessPR.asp • 3Com

– http://emea.3com.com/news/news01/mar26.html • Agere

– http://www.networkmagazine.com/article/COM20010629S0009 – http://www.lucent.com/micro/NEWS/PRESS2001/080801a.html

• Enterasys – http://www.dialelectronics.com.au/articles/c4/0c0023c4.asp – http://www.computingsa.co.za/2001/03/26/News/new07.htm

• Intersil – http://www.intersil.com/pressroom/20010403_802_1xWindows_XPFINA

L_English.asp • Cisco

– Catalyst switches • http://www.redcorp.com/products/09084608.asp

– 802.11 access points • http://www.security-informer.com/english/crd_security_495312.html • http://cisco.com/warp/public/cc/pd/witc/ao350ap/prodlit/1281_pp.pdf

NSRI

43

Cisco Mutual Authendication

NSRI

44

WLAN 보안 취약점

Summary

NSRI

45

Summary

• 802.11 Security doesn’t meet any of its security objectives today • 802..11 Tge is working to replace

– Authentication scheme using 802.1x and kerberos – Encryption scheme using AES in OCB mode

• Some Hints – Always possible to setup IPsec/VPN – 128비트 블록암호를 사용 – 기밀성과 무결성을 동시에 해결 가능한 방법 – IV 재 사용 금지 : 메시지 키 개념 도입 – CRC checksum 메시지 인증을 위한 MAC 추가(블록암호) – 인증 프로토콜 재 설계 (replay attack 강한 프로토콜) – 비밀키 기반 인증 방식인 Kerberos 방식등 – 키 설정 방법 및 IV 발생방법등에 대한 구체적 방법

• 단기미봉책 – 키관리방안, IPSec, Firewall 등

• 업체의 제품 – 신뢰성 검증 미흡 – 대부분 단기 미봉책

• 좀더 심도있는 보안 연구 필요

NSRI

46

Sniffing 802.11

NSRI

47

WLAN 보안 Solution

TKIP

NSRI

48

Encryption Process

MIC Key TKIP sequence counter(s)

SA + DA +

Plaintext MSDU

Data

Ciphertext

MPDU(s)

WEP

Encapsulation

MIC

TTAK Key

Plaintext

MSDU +

MIC Fragment(s)

Phase 2

key mixing

Plaintext

MPDU(s)

WEP seed(s)

(represented as

WEP IV + RC4

key)

Phase 1

key mixing TA

Temporal

Key

NSRI

49

Decryption Process

MIC Key

WEP IV

Plaintext

MSDU

Ciphertext

MPDU

WEP

Decapsulation

Michael

TTAK Key

SA + DA +

Plaintext

MSDU

Reassemble

Key mixing

Plaintext

MPDU

WEP Seed

Phase 1

key mixing

TA

Temporal

Key

TKIP sequence counter

Unmix IV

In-sequence

MPDU

Out-of-sequence

MPDU

MIC

MIC

MIC =

MIC?

MPDU with failed

WEP ICV

MSDU with failed

TKIP MIC

Countermeasures

NSRI

50

WLAN 보안 Solution

VPN

NSRI

51

Inner VPN 개념

각종 서버

XecureVPN

Gateway

XecureVPN

AP

이동 단말기

(1) AP내부에 VPN 구현

(2) VPN Gateway활용

유선구간

무선구간

NSRI

52

Inner VPN

NSRI

53

WLAN 보안 Solution

Vendor

NSRI

54

Cisco’s Solution

• Mutual authentication – By Lightweight & Efficient Application Protocol-LEAP – Between a wireless client and a backend RADIUS

• Secure Key Derivation – Mutual challenge and one-way hashes

• Dynamic WEP keys – Dynamic per-user, per-session WEP key – Unique session key per users

• Reauthentication Policies – RADIUS server ACS2000 – Reauthentication more open – Get new session keys

• IV Changes – A per-packet basis

• Use other security solutions – VPN, Firewall

NSRI

55

3COM’s Solutions

• Layer 3 VPN solutions

– RADIUS-based authentication & authorization

– 128bits Dynamic session Key

• WEP에 근간을 둔 보안이 아니라 클라이언트와 라우터간의

VPN을 수행함으로써 WLAN의 보안을 처리

NSRI

56

NoWiresNeeded’s Solution

• AirLockTM Security Software

• Automated key exchange

• Encryption : RC4 and 128bit key

• Key agreement : Diffie-Hellman key agreement

• Authentication : public key mechanism, using 1024bit keys

• Also, supports IEEE standard WEP 40

NSRI

57

감사합니다.