ZDNet UK

CBS INTERACTIVE UK BUSINESS SITES:
atlarge.com
BNET UK
silicon.com
SmartPlanet.com
ZDNet.co.uk

You are here: ZDNet.co.uk > News > Communications

Mobile working Toolkit

Better ways emerge to protect wireless data

Brien M Posey Tech Republic

Published: 20 Aug 2003 15:20 BST

For several years now, the primary security mechanism used between wireless access points and wireless clients has been WEP encryption. The problem is that although WEP encryption strength has increased a few times since Wi-Fi was introduced, the WEP protocol is still fundamentally weak because it uses a static encryption key. As a result, motivated attackers can easily crack WEP encryption by using freely available hacking tools.

Fortunately, some standard alternatives to WEP are emerging. The Institute of Electrical and Electronics Engineers (IEEE) has defined an expansion to the 802.11 protocol that will allow for increased security. Unfortunately, the standard is presently in draft form and isn't expected to be ratified until the end of 2003. In the meantime, though, most of the Wi-Fi manufacturers have agreed to use a temporary standard for enhanced security called Wi-Fi Protected Access (WPA). Although WPA is a temporary protocol and isn't recognised by IEEE, it is very similar to the revised IEEE standard expected by the end of the year. Therefore, administrators that manage wireless LANs should become familiar with WPA.

802.1X authentication
If you have been using Wi-Fi for a while, you are probably familiar with the 802.1X authentication protocol. This protocol allows users to authenticate into a wireless network by means of a Radius Server. In standard Wi-Fi, 802.1X authentication is optional. However, 802.1X authentication is a requirement for WPA.

If your environment does not have a Radius server in place, you can still use WPA in spite of the 802.1X requirement. As an alternative to Radius, WPA supports the use of a pre-shared key.

WPA key management
One of the biggest drawbacks to traditional WEP security is that changing the encryption key is optional. Even if you do switch encryption keys from time to time, there is no option for globally re-keying all access points and all wireless NICs. Instead, re-keying is a tedious manual process and is completely impractical for large organisations. After all, the instant you re-key an access point, none of the clients will be able to access it until they are also re-keyed.