BULLETPROOF WIRELESS SECURITY
CONTENTS APTER 1: SECURITY AND CRYPTOGRAPHY 1 1 WHAT IS SECURITY? 1 2 CRYPTOGRAPHY 1 2 1 CON?DENTIALITY 1 2 2 INTEGRITY 1 2 3 AUTHENTICATION 1 2 4 REPLAY PROTECTION AND NONREPUDIATION 1 3 CRYPTANALYSIS 1 4 BLOCK CIPHERS 1 4 1 USING THE CIPHERS: THE MODES 1 5 STREAM CIPHERS 1 6 HOW SECURE IS CRYPTOGRAPHY? 1 6 1 STRENGTH OF A CIPHER 1 6 2 KEY-LENGTH: HOW LONG IS SECURE? 1 7 BEYOND CRYPTOGRAPHY 1 7 1 FIREWALLS 1 7 2 DENIAL OF SERVICE ATTACKS 1 7 3 CODE SECURITY 1 7 4 STEGANOGRAPHY 1 8 CONCLUSION CHAPTER 2: NETWORK SECURITY PROTOCOLS 2 1 INTRODUCTION 2 2 KEY ESTABLISHMENT PROTOCOLS 2 2 1 KEY GENERATION IN SKC CH 2 2 2 KEY DISTRIBUTION IN SKC 2 2 3 KEY ESTABLISHMENT IN PKC 2 2 4 DIF?E-HELLMAN KEY EXCHANGE 2 2 5 ENHANCED DIF?E-HELLMAN KEY EXCHANGE 2 2 6 RSA 2 3 AUTHENTICATION PROTOCOLS 2 3 1 ADDRESS-BASED AUTHENTICATION 2 3 2 PASSWORDS FOR LOCAL AUTHENTICATION (LOGIN) 2 3 3 PASSWORDS FOR NETWORK AUTHENTICATION 2 3 4 AUTHENTICATION USING SKC 2 3 5 AUTHENTICATION USING PKC 2 3 6 WHAT TO USE FOR AUTHENTICATION: SKC OR PKC? 2 3 7 SESSION HIJACKING 2 3 8 NEEDHAM SCHROEDER 2 3 9 KERBEROS 2 4 ENCRYPTION PROTOCOLS 2 4 1 DES 2 4 2 TRIPLEDES OR 3DES 2 4 3 AES 2 4 4 RC4 2 5 INTEGRITY PROTOCOLS 2 5 1 CBC RESIDUE 2 5 2 CRC32 2 5 3 MD5 CHAPTER 3: SECURITY AND THE LAYERED ARCHITECTURE 3 1 INTRODUCTION 3 2 SECURITY AT LAYER 1 3 3 SECURITY AT LAYER 2 3 3 1 EXTENSIBLE AUTHENTICATION PROTOCOL (EAP) 3 3 2 EAPOL: EAP OVER LAN 3 3 3 EAP-TLS: TLS HANDSHAKE OVER EAP 3 4 SECURITY AT LAYER 3 3 5 SECURITY AT LAYER 4: SSL/TLS 3 6 SECURITY AT LAYER 5+ CHAPTER 4: VOICE-ORIENTED WIRELESS NETWORKS 4 1 THE WIRELESS MEDIUM 4 1 1 RADIO PROPAGATION EFFECTS 4 1 2 HIDDEN TERMINAL PROBLEM 4 1 3 EXPOSED TERMINAL PROBLEM 4 1 4 BANDWIDTH 4 1 5 OTHER CONSTRAINTS 4 2 THE CELLULAR ARCHITECTURE 4 3 TWNS: FIRST GENERATION 4 3 1 ADDRESSES IN AMPS 4 3 2 CALL SETUP IN AMPS 4 4 TWNS: SECOND GENERATION 4 4 1 ADDRESSES IN GSM 4 4 2 CALL SETUP IN GSM 4 5 TWNS: THIRD GENERATION 4 5 1 CONNECTION SETUP IN UMTS 4 6 THE OVERALL PICTURE CHAPTER 5: DATA-ORIENTED WIRELESS NETWORKS 5 1 WLANS 5 1 1: ADDRESSES IN 802 11 5 1 2 CONNECTION SETUP IN 802 11 5 1 3 MEDIA ACCESS 5 1 4 SPECTRUM EF?CIENCY IN 802 11 5 2 MANETS 5 2 1 MAC FOR MANETS 5 2 2 ROUTING IN MANETS 5 2 3 ADDRESS ALLOCATION IN MANETS 5 2 4 SECURITY IN MANETS 5 3 WIRELESS NETWORKS IN THE NEAR FUTURE CHAPTER 6: SECURITY IN TRADITIONAL WIRELESS NETWORKS 6 1 SECURITY IN FIRST GENERATION TWNS 6 2 SECURITY IN SECOND GENERATION TWNS 6 2 1 ANONYMITY IN GSM 6 2 2 KEY ESTABLISHMENT IN GSM 6 2 3 AUTHENTICATION IN GSM 6 2 4 CON?DENTIALITY IN GSM 6 2 5 WHAT’S WRONG WITH GSM SECURITY? 6 3 SECURITY IN 2 5 GENERATION TWNS 6 3 1 WAP 6 3 2 CODE SECURITY 6 4 SECURITY IN 3G TWNS 6 4 1 ANONYMITY IN UMTS 6 4 2 KEY ESTABLISHMENT IN UMTS 6 4 3 AUTHENTICATION IN UMTS 6 4 4 CON?DENTIALITY IN UMTS 6 4 5 INTEGRITY PROTECTION IN UMTS 6 4 6 PUTTING THE PIECES TOGETHER 6 4 7 NETWORK DOMAIN SECURITY 6 5 SUMMARY CHAPTER 7: SECURITY IN WIRELESS LOCAL AREA NETWORKS 7 1 INTRODUCTION 7 2 KEY ESTABLISHMENT IN 802 11 7 2 1 WHAT’S WRONG? 7 3 ANONYMITY IN 802 11 7 4 AUTHENTICATION IN 802 11 7 4 1 OPEN SYSTEM AUTHENTICATION 7 4 2 SHARED KEY AUTHENTICATION 7 4 3 AUTHENTICATION AND HANDOFFS 7 4 4 WHAT’S WRONG WITH 802 11 AUTHENTICATION? 7 4 5 PSEUDO-AUTHENTICATION SCHEMES 7 5 CON?DENTIALITY IN 802 11 7 5 1 WHAT’S WRONG WITH WEP? 7 6 DATA INTEGRITY IN 802 11 7 7 LOOPHOLES IN 802 11 SECURITY 7 8 WPA 7 8 1 KEY ESTABLISHMENT 7 8 2 AUTHENTICATION 7 8 3 CON?DENTIALITY 7 8 4 INTEGRITY 7 8 5 THE OVERALL PICTURE: CON?DENTIALITY + INTEGRITY 7 8 6 HOW DOES WPA FIX WEP LOOPHOLES? 7 9 WPA2 (802 11I) 7 9 1 KEY ESTABLISHMENT 7 9 2 AUTHENTICATION 7 9 3 CON?DENTIALITY 7 9 4 INTEGRITY 7 9 5 THE OVERALL PICTURE: CON?DENTIALITY + INTEGRITY CHAPTER 8: SECURITY IN WIRELESS AD HOC NETWORKS 8 1 INTRODUCTION 8 2 ROUTING IN MULTIHOP AD HOC NETWORKS 8 2 1 PROACTIVE ROUTING 8 2 2 REACTIVE ROUTING 8 2 3 HYBRID ROUTING 8 2 4 ROUTING ATTACKS 8 2 5 SECURE ROUTING 8 3 KEY ESTABLISHMENT AND AUTHENTICATION 8 3 1 THRESHOLD SECRET SHARING 8 4 CON?DENTIALITY AND INTEGRITY 8 5 BLUETOOTH 8 5 1 BLUETOOTH BASICS 8 5 2 SECURITY MODES 8 5 3 KEY ESTABLISHMENT 8 5 4 AUTHENTICATION 8 5 5 CON?DENTIALITY 8 5 6 INTEGRITY PROTECTION 8 5 7 ENHANCEMENTS REFERENCES