Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

[Christian Huitema <[e-mail]>]

On Friday, August 28, 2015 12:14 PM, Christian Huitema wrote:
> ...
> This is in fact the main limitation to Warren's approach. The proposed OWE
> system will still be vulnerable to passive listener attacks, and is thus not much of
> an improvement over open networks.
> 
> Note that this is also a limitation of the "public password" approach, as in "ask
> the password to the bartender." We can hypothesize that mass surveillance
> systems will quickly build a database linking networks, SSID and public
> passwords. After all, the initial WPA2 exchange carries authentication codes that
> are the hash of the nonce and the password, which trivially enables dictionary
> attacks. That means the procedure will be:
> 
> 1) Capture the initial exchange between Station and Access point, and
> remember the nonce.
> 2) Retrieve the password associated to the SSID from the database.
> 3) Derive the per station key using the nonce.
> 4) Win!
> 
> Thinks would be different if instead of just sending the nonce in clear text the
> WPA2 exchange used some variation of Diffie-Hellman or EKE. Attackers would
> need to move from "passive listening" to "actively implement MITM attack," and
> we believe that might curtail mass surveillance efforts. But that's not the case.

In fact, there is a way out, but it requires a bit more coding than Warren's simple hack.

Suppose that instead of using WPA2-PSK, the access point would be using 802.1x and EAP-Password (RFC 5931). 

Suppose that in addition, the AP will send an information element explaining that it uses the OWE convention, which means that the user name is "anonymous" and the password is the name of the SSID.

The updated station automatically proceeds with the authentication. This results in the derivation of a one-time session key, which is not vulnerable to dictionary attacks and the like. It is still vulnerable to MITM attacks, but that's kind of the definition of opportunistic security.

A variation of the implementation would define that the user name is "anonymous" and that the user needs to enter a password. That variation would be as easy to use as WPA2-PSK, but would be protected against dictionary attacks.

Now of course that requires a fair amount of coding: implement this EAP Password variation in the AP, and make sure it is available in the clients. But we would have actually improved Wi-Fi security, without compromising the user experience.

-- Christian Huitema