Schweitzer Engineering Laboratories SEL-3022 Instruction Manual Download

Page: 89 / 106

Date Code 20050615

Instruction Manual

SEL-3022 Transceiver

Wireless Operator Interface Security

IEEE 802.11 WEP Security

C.7

Cryptographic Manual—Do Not Copy

The weaknesses Fluhrer, Mantin, and Shamir described are a direct consequence of the
RC-4 algorithm. These researchers demonstrated that there are large classes of keys for
which a very small portion of the key determines a very large portion of the KSA
output. Furthermore, Fluhrer, Mantin, and Shamir showed that the PRGA function is
weak in the sense that known patterns in the KSA output are transformed into
predictable patterns in the first byte of the PRGA output. In other words, for a large
number of keys, the first byte of the PRGA output is highly correlated with a very
small number of key bits. This correlation can be used, in certain situations, to guess
the value of the secret key. The implementation of the WEP algorithm ensures that
these weaknesses can be exploited in an effective manner. Because the WEP algorithm
transmits the IV unencrypted with each packet, an attacker has full visibility of three
bytes of the KSA input. Furthermore, the first encrypted byte of almost every IEEE
802.11 packet is a known constant. This is a direct consequence of the fact that the first
encrypted byte of an IEEE 802.11 packet is the Destination Service Access Point
(DSAP) field of the LLC header, which has a value of 0xAA (hexidecimal) for all
packets containing TCP/IP protocol data. This known value allows an attacker to
recover the first byte of the PRGA output for virtually every packet by simply XORing
the first byte of ciphertext with the value 0xAA. Someone could attack WEP by
observing the IV values of each encrypted packet transmitted on the network to find
weak values that result in the leak of information about the value of a particular secret
key byte into the first byte of the PRGA output. An attacker could repeat this process
until all bytes of the secret key are determined with sufficiently high probability.

The 802.11b wireless LAN protocol provides a very effective wireless networking
solution, which has resulted in steadily growing popularity of 802.11b-compliant
networking devices, or access points (APs), since the introduction of the standard. This
great popularity of such technology has fueled the development of software utilities
designed to locate active wireless APs and identify whether WEP encryption is enabled
on these devices.

If an attacker finds an AP protected by WEP encryption but interesting enough to
warrant further investigation, the attacker can attempt to crack the WEP key. Several
tools can passively capture normal wireless traffic on a target network and exploit the
security flaws previously discussed to potentially determine the WEP encryption key
used to secure the transmitted data. These tools have the potential to guess a WEP key
by passively observing as few as four million network packets. Clearly, the time that
this process takes is dependent on the average amount of network traffic that the 802.11
wireless network transmits.

Implications of WEP Security Flaws

Because of the previously discussed flaws, the WEP encryption function the 802.11
standard specifies does not provide the advertised 104 bits of cryptographic key
strength. It does, however, provide a rather significant barrier to a potential attacker. It
is difficult to determine the WEP key from a lightly loaded wireless network. A
wireless connection between a maintenance PC and an SEL-3022 will only transmit
network packets while the session is open and data are being actively exchanged
between the PC and the SEL-3022. Under normal conditions, a potential attacker

Preliminary Copy