So, how does WPA allow us to form encryption keys?
Again, we mentioned that the pre-shared key is not the encryption key, so
whether we're
doing personal or enterprise, we do need to somehow get to the keys.
And we're going to use a process known as the four-way handshake.
This is a rather famous or potentially infamous method that could talk about an
awful lot
when it comes to our wireless security conversations.
So the point that this shows up on the blueprint for this exam. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the point that this shows up on the blueprint for this exam.
When a wireless station wants to join a wireless network, we're going to go
through this four-way
handshake process, and it's initiated by the access point.
So message number one gets sent down to the station, message two gets sent back
to the
AP, then we have a third message and a fourth message.
Now from a wireless perspective, we have to acknowledge wireless messages.
And so each one of these also gets acknowledged, which allows the other side to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so each one of these also gets acknowledged, which allows the other side to
know that
it was properly received.
So we could argue that there's eight messages here, but usually acknowledgments
aren't considered
part of the wireless communication.
I just wanted to point out that there is an acknowledgment with each one.
Message two doesn't acknowledge message one, for example, even though we could
argue that
it kind of does, because we wouldn't be sending it.
If we hadn't received the first message.
Now when we're talking about WPA personal, this is a fairly straightforward WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now when we're talking about WPA personal, this is a fairly straightforward
process,
because WPA personal is just going to use the PSK.
Now as we mentioned, the pre-shared key is not going to be my encryption key.
I am deriving the encryption keys as part of this process, but it's the PSK
that's going
to allow me to initiate this process.
And so I simply follow the four way handshake, and we end up with a key on both
sides.
So I've got a key over here, and I've got an encryption key over here, and now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I've got a key over here, and I've got an encryption key over here, and now
we can
encrypt our traffic.
So we go through this process, no problem.
Personal addition is pretty straightforward.
Things get a little more complicated when we're talking about the enterprise
addition, because
as we mentioned, the enterprise version of WPA is going to require an
authentication
server in the 802.1x architecture.
So we're typically going to use radius for this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're typically going to use radius for this.
And the way this works is that when the station wants to authenticate to the
access point,
we're actually going to start with a bunch of EAP messages.
Depending on our EAP type, this might be a few messages.
This might be a lot of messages, but we have to perform our authentication
first.
So this is going to involve communications on the back end again with this
radius server.
The authenticator or access point in this case, or possibly a wireless LAN
controller,
is going to have to communicate as part of this process. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to have to communicate as part of this process.
There's a lot of back and forth that happens here before we even get to the WPA
four way
handshake.
But once EAP process is done and we have fully authenticated this device, which
remember,
we did authenticate the device before, but that included just having the pre
shared key
on the personal side.
It provides both the derivation of our encryption keys and our authentication
mechanism.
But here we have a different authentication mechanism.
So we start there, prove we belong on the network, and now we need to derive WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we start there, prove we belong on the network, and now we need to derive
the encryption
keys.
So we're still going to then see that the four way handshake progresses.
This is our WPA four way handshake.
And then the result of this is our encryption keys, which is one of the
ultimate goals is
to be able to encrypt our wireless traffic.
Now an important part of anything when it comes to security and authentication
is to
consider the impact of roaming. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
consider the impact of roaming.
So we talked a little bit about roaming earlier.
Roming can be very disruptive.
Roming is when I move from one access point to another because I get out of
range of this
AP and I'm in range of this new AP, I'm migrating this way.
Well, if I'm not using some help using the wireless LAN controllers, I have to
go through
this whole process again.
I have to do the four way handshake here to start with one, two, three, four,
and potentially WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and potentially
all the EAP communications to start with.
Well, guess what?
When I want to now associate, I'm over here.
I want to associate to this access point, I'm going to have to do the whole
thing all
over again, including the four way handshake.
This is enough to make it so that we might drop phone calls.
We might result or this might result in us losing communications on the Wi-Fi
long enough
to disrupt whatever application we're in the middle of using. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to disrupt whatever application we're in the middle of using.
This is why we want to use wireless LAN controllers to facilitate roaming
because now the authentication
can be passed from one access point to another and make it so I can skip all of
this.
So this is mitigated heavily with wireless LAN controllers as well as some form
of key
management that Cisco allows on the wireless LAN controllers, but do keep in
mind if we're
not using that, then roaming is made all the more disruptive by the security
mechanisms.
So it's something that we need to be aware of. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it's something that we need to be aware of.
Now at the end of all this, before we move on to the next conversation, I do
want to
point out that WPA falls into the category of layer two security.
And we'll see this referenced in the configuration of our wireless LAN
controllers.
Layer two is where Wi-Fi exists and WPA is the name implies with Wi-Fi right in
there,
Wi-Fi protected access, WPA exists within the realm of Wi-Fi and therefore it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Wi-Fi protected access, WPA exists within the realm of Wi-Fi and therefore it's
layer
two security.
I have to go through this four way handshake one way or the other.
Personal or enterprise, I have to go through that process just to get
associated to the
access point and onboard it onto the network.
And what we'll find is that there are layer three security mechanisms as well,
which won't
leverage native wireless association.
But this is how the four way handshake comes together.
And this is why it's so important that we understand this process, especially
potentially
as it relates to roaming and the fact that our enterprise four way handshake WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as it relates to roaming and the fact that our enterprise four way handshake
has to follow
the EAP process.