Home: www.packetnexus.com
What's up with WEP? Don't let it compromise your data Larry Loeb (larryloeb@prodigy.net) Author, Secure Electronic Transactions April 2001 Wired Equivalent Protocol, or WEP, is the security behind the wireless IEEE 802.11 protocol. IEEE 802.11 is used by many manufacturers as the wireless extension of the networks that feed computers. Trouble is, the design of WEP allows eavesdroppers to decode the WEP-encrypted messages fairly simply, and thus gain access to networks and data. Here, Larry takes an in-depth look at WEP -- what it is, how it's flawed, how serious those flaws are, and what can be done about them. The Possible Dream Wireless networking (and connectivity to a base network) has been a dream of users since portables first appeared. One technology that has become popular recently is the "Wi-Fi" wireless LAN. Operating at 2.4GHz, this is a radio-based way to link computers to networks with an acceptable connection bandwidth. As wireless networking enthusiast John Saxton notes, "'Wi-Fi' was designed and developed by IEEE P802 members, including Lucent (now Agere) and Harris (now InterSil), who have been shipping wireless Ethernet LANs for years." These were the supposed experts in this area, so their work (codified as the standard IEEE 802.11b ["802.11" for brevity]) should have been exemplary 802.11 is the IEEE's solution to the problem of how to comprehensively network disparate computing elements over relatively short physical distances. The IrDA infrared link used in the Palm PDA is another defined solution to the same problem. IrDA allows PDAs to communicate with their IrDA-hardware-equipped hosts (as well as each other) right out of the box, over short distances. 802.11 aims to provide the same seamless functionality, but on a larger physical scale. The device-to-access-point distance is increased by the use of radio waves, and the data flow has been encrypted in what is referred to as the Wired Equivalent Protocol, or WEP. WEP WEP is part of the system security of 802.11, and its goals are to provide confidentiality and data integrity, and to protect access to the network infrastructure by rejecting all non-WEP packets. WEP uses a secret key shared between the communicators. Some versions use the 40-bit key that was originally used to formulate the standard, while other newer versions use a 128-bit (104 in reality) key. The actual encryption/decryption process looks like this: The data frame is checksummed (using the CRC-32 algorithm) to obtain c(M), where M is the message. M and c(M) are concatenated to get the plain text P=(M, c(M)). P is encrypted using the RC4 algorithm. This generates a keystream as a function of the initialization vector (IV) v and the secret key k; which is notated as RC4 (v, k). The cipher text results from applying the XOR function to the plain text and the keystream. The cipher text and the IV are then transmitted via radio. Graphically, the process looks like this: Decryption is simply the reverse of encryption. The recipient regenerates the keystream and XORs it against the cipher text to recover the initial plain text. This message (P') is then split into the two parts of M' and c'. c(M') is then computed and compared with the received checksum c'. If it does not match, then the message body has changed in some manner during transmission. Decryption generates the identical keystream used for encryption using the transmitted-with-the-packet IV and the shared secret key. Finally, the result is XORed with the cipher text to reveal the message. WEPbusters come calling It can