May 25, 2013

1.6.3 WEP

WEP

Wired Equivalent Privacy (WEP) is the original security standard used in wireless networks to encrypt the wireless network traffic1. It adds security to 802.11 Wi-Fi networks at the data link layer (OSI model Layer 2) using a combination of hexadecimal digits.

Hexadecimal digits include ten numbers (0 – 9) and six letters (A – F). WEP uses a combination of these hexadecimal digits to create WEP keys. For example:
8734CDEA08432FACDE65748ACC
There are three keys sizes in use with WEP: 10, 26 and 58 digit key lengths.

A 10 digit hexadecimal key size results in a 40 or 64-bit WEP key. Note: each hexadecimal character represents four bits, resulting in a 40-bit key. 40-bit keys can be concatenated with a 24-bit initialization vector (IV) to generate a 64-bit WEP key.

A 26 digit hexadecimal key size results in a 104 or 128-bit WEP key. Note: as each hexadecimal character represents four bits, this yields a 104-bit key. If this is concatenated with a 24-bit initialization vector (IV) it generates a (104 + 24) or 128-bit WEP key.

A 58 digit hexadecimal key size results in a 256-bit WEP key, which includes the 24-bit IV.
WEP Encryption Process
A WEP key is concatenated with an initialization vector (IV), and this combined key is used as the seed for an RC4 keystream that is XORed (exclusive OR) with the wireless LAN data. A different IV stream is used for each frame, and therefore a different combined key is used to create a new RC4 keystream for each frame.

Vulnerabilities have been exposed where repeated IVs, along with the adaptation of a stream cipher (RC4) to create the block cipher, have resulted in an insecure encryption mechanism that can be cracked with what are now commonly available tools.2

Note: XOR is a logical operation which yields true if exactly one (but not both) of two conditions is true.3

Note: WEP is no longer considered to be secure.4

References:

No comments:

Post a Comment