3e–525C–3 Wireless Access Point
Chapter 1: Introduction
6
29000171-001 A
3e–525C–3 Wireless Access Point
Chapter 1: Introduction
29000171-001 A
7
WPA/WPA2 with TKIP/ AES-CCMP
WPA, an interim standard developed by the WiFi Alliance, combines
several technologies. It includes the use of the 802.1x standard and the
Extensible Authentication Protocol (EAP). In addition, it uses, for encryp-
tion, the Temporal Key Integrity Protocol (TKIP) and WEP 128-bit encryp-
tion keys. Finally, a message integrity check (MIC) is used to prevent an
attacker from capturing and altering or forging data packets. In addition,
it can employ a form of AES called AES-CCMP.
WPA is a subset of the 802.11i standard and is expected to maintain
forward compatibility.
802.11i
Four major categories or primary functions of 802.11i are invoked
within 3eTI products, including the wireless client devices, wireless ac-
cess points, and the security server. These primary functions of 802.11i
include:
• EAP-TLS: Extensible Authentication Protocol Transport
Layer Security, EAP-TLS was compulsory for WPA2 Enter-
prise products certified prior to April 15, 2005; for products
certified after this date, EAP-TLS testing is compulsory if
the product can support EAP-TLS. The only products that
might not support EAP-TLS are tightly integrated systems
that do not support software upgrades by a third party, such
as some cell phones intended for, e.g., the 3G market. Non-
tightly integrated products like most laptop and PDU adapt-
ers still must support EAP-TLS to receive WPA2 certifica-
tion. 3eTI wireless client and wireless access point devices
use standards-based EAP-TLS with no modifications, for
complete interoperability with 802.11i and WPA2 certified
equipment.
• IEEE 802.1X: also known as port based network access con-
trol, 802.1X provides and authentication framework within
802.11i. 802.11i depends upon 802.1X to control the flow of
MSDUs between the DS and STAs by use of the IEEE 802.1X
Controlled/Uncontrolled Port model. IEEE 802.1X authen-
tication frames are transmitted in 802.11 Data frames and
passed via the IEEE 802.1X Uncontrolled Port. The 802.1X
Controlled Port is blocked from passing general data traffic
between two STAs until an 802.1X authentication procedure
completes successfully over the 802.1X Uncontrolled Port. It
is the responsibility of the authenticator (3eTI Access Point)
to implement port blocking. 802.11 depends upon IEEE
802.1X and the EAPOL-Key 4-Way and Group Key Hand-
shakes, to establish and change cryptographic keys. Keys
are established after authentication has completed. Keys
may change for a variety of reasons, including expiration
of an IEEE 802.1X authentication timer, key compromise,
