Evolution of WLAN Security

"In this video, I will discuss the evolution of wireless LAN security starting from WEP. It was part of the 802.11 VLAN initial standard and was introduced with VLANs in 1997. Then its next version was WEP2, which was an early draft of the 802.11i wireless LAN security protocol. However, this was a non-standard fix for vulnerabilities in WEP.
Then came Wi-Fi Protected Access (WPA), which was also a fix for WEP vulnerabilities. It implemented a subset of the 802.11i draft protocol in 2003. WPA2, was introduced in 2004. Many years later, in 2018, 802.11i was enhanced to WPA3, which became part of 802.11s, a VLAN protocol for mesh networks.
Now, moving on to WEP or Wired Equivalent Privacy, WEP was introduced as part of the VLAN VLAN protocol, 802.1, mandatory for 802.11 wireless access points at that time. 802.11a and B. WEP used the RC4 stream cipher with a 64-bit key, also known as WEP-40 due to the 40-bit key and 24-bit initialization vector (IV). Cyclic Redundancy Check (CRC) was used for integrity.
The limitation of using a 64-bit key was due to restrictions by the US government on encryption. When these restrictions were lifted, the RC4 key was increased to 128 bits in WEP2, also known as WEP-104 (with a 104-bit key, including the 24-bit IV). This key was used to encrypt network traffic, but other versions like WEP-152 and WEP-256 were introduced by some vendors.
In 2001, a paper was published outlining attacks on WEP, including the FMS attack. This attack exploited short IVs, which allowed the reconstruction of the WEP key. This vulnerability enabled hackers to decrypt encrypted traffic and conduct other attacks. Automated tools like Aircrack-ng facilitated these attacks. Other vulnerabilities, short 40-bit key size and related key attacks due to improper IV handling.

WEP was an optional protocol to secure 802.11 wireless LANs and was not always activated or used by organizations. The WEP-40 key was shared among all clients, posing a security risk. Café Latte attack flooding the wireless LAN with ARP packets, analyzing responses to derive the WEP key.
Recommendations for clients included using IPSec, SSH tunnels, or secure wireless protocols, but these were not fixes for WEP itself. WEP was deprecated in 2004 by WPA2, but some devices and vendors continued using WEP, leading to security breaches like the TJX data breach in 2007. In 2018, PCIDSS prohibited the use of WEP for credit card processing systems.
Moving on to WEP2, it was designed for wireless access point hardware that did not support WPA or WPA2. It extended the initialization vector and RC4 keys to 128 bits but still required more fixes.

A quick fix known as WPA, based on the draft 802.11i standard, was introduced by the Wi-Fi Alliance in 2003 to address WEP vulnerabilities. It supported legacy hardware and low-computational wireless access points. By upgrading the firmware of these access points and network cards, users could transition to WPA. WPA, also known as TKIP (Temporal Key Integrity Protocol), shared a key among all clients. The introduction of pairwise key integrity protocol (PKIP) assigned a unique key to each client. WPA retained the extended initialization vector and RC4 key of 128 bits from WEP2. The cyclic redundancy check was replaced by a message integrity check, though this was also found to have vulnerabilities. The TKIP itself was found to inherit vulnerabilities from WEP, with RC4 keys being recoverable by attackers.

WPA2, introduced in 2004 and valid until 2018. It replaced the RC4 stream cipher and TKIP with AES (Advanced Encryption Standard) 128-bit counter mode for data confidentiality. CBC-MAC (Cipher Block Chaining Message Authentication Code) replaced the message integrity check and CRC of WPA. A four-way handshake was introduced for key exchange, utilizing pairwise transient keys (PTK) for single-client traffic encryption and group transient keys (GTK) for broadcast traffic.
The 802.11g series and some 802.11b devices received this certification through firmware updates.
In 2016, Key Reinstallation Attack (KRACK) demonstrated weaknesses in WPA2, forcing the reinstallation of keys by manipulating the four-way handshake.
Lastly, the latest evolution in wireless LAN security is WPA3, introduced in 2018. Initially for 802.11s mesh networks, it became an overall standard for wireless LAN security. Certification of devices began in June 2018, and the Wi-Fi Alliance mandated its logo for devices built after July 2020. WPA3 offers two modes: Personal and Enterprise. Personal mode uses the same CCMP as WPA2, suitable for small networks or homes. Enterprise mode utilizes AES-256 in GCM mode for data encryption and SAE (Simultaneous Authentication of Equals) for key exchange, providing perfect forward secrecy. SAE is based on the Diffie-Hellman key exchange.
WPA3 also simplifies device setup without a display.