Hello and welcome to this video titled, Breaking Down the RSN Key Derivation.
So in case you've forgotten, RSN stands for the robust security network,
which was first defined in the 802.11i standard by the IEEE, which sort
of defined all of how Wi -Fi security takes place.
And within that robust security network, there is a series of keys.
And here we see a review of that.
And most keys are derived from other keys that were created beforehand.
So we'll talk about each of these in this particular video, starting with
the master session key, working our way down through the pairwise master
key, and so on and so forth.
And we'll also take a look at some of these keys on the right here, used
for broadcast and multicast.
So before we talk about what the master session key is and how it's used,
let's just real quickly look at where it comes from and how you get it.
So the master session key is only applicable when you're doing WPA enterprise.
So we're talking about a full 802.1x implementation with an authentication
server, typically doing radius on the back end.
So if that's true, then the Wi-Fi supplicant, which is your laptop, your
smartphone, whatever, will typically start the whole process with an EPU
over land dash start message.
Very simple message just basically saying, hey, I wanna gain access to
the network. Then we'll have several back and forth exchanges of EPU over
land dash packet messages.
Now these are all carried with a layer two ether type value of 0x888E.
So if you wanted to capture those in wire shark or something, that's what
you'd wanna filter on, is that ether type value of 0x888E.
But inside they have different EPU types.
So how many EPU over land dash packet exchanges there are really is dependent
on what EPU method you're using.
Some EPU methods like EPU MD5, which is simply just an exchange of a username
and password, don't have a whole lot of messages that go back and forth.
Other EPU methods, which are much more complex, which use like digital
certificates and things like EPU TLS, will have a lot more EPU over land
packet messages.
But the really thing we gotta focus on here is, are you going to authenticate
or not? If you don't authenticate, then you're done and you don't get
your network access.
If you do authenticate, then the very last EPU over land dash packet message
coming from that authentication server.
So he'll say, great, you're authenticated, you've passed my tests, you've
given me the credentials I need, so the very last EPU over land packet
that he will send down to the access point, which will then be translated
into a wired frame into a wireless frame and then sent to you wirelessly,
will contain a special key that that radius server created called the
master session key.
Now I'm just giving a random example here, it's gonna be much, much longer
than this, as we'll see in just a second, but there's really two main
points here. Number one, actually three main points.
Number one, this key, this master session key, only is created after a
successful 802.1x authentication.
So we're talking WPA enterprise here.
All right, number two, it's created by the radius server and sent down
to you in the very last EPU over land packet message and then number three,
both your supplicant and the access point will need to have that.
So in this case, most of these EPU over land packet messages that have
gone back and forth, the authenticator, which is the access point, has
just kind of transparently passed them back and forth.
It's received them in as wireless frames, convert them into wired ethernet
frames and then folded them on to the authentication server, putting them
inside of radius packets.
But other than that, it hasn't really paid much attention to the back
and forth exchange between the two endpoints.
Now with this very last message here, the actual message type will have
a radius code, the radius is the protocol on the wired side and it will
say access except.
So he can now access the network, access except.
When the authenticator, whether it be a wired switch or in this case an
access point, when it sees that, it will pay attention to that message.
Number one, it'll say, okay, now I know I can open up network access to
this client. He's passed all the rules, all the requirements.
The authenticator will also say, okay, let me look into that access except
message and see if there's any instructions for me.
Because maybe that access except message will also tell me to do things
like, dynamically put this person into a VLAN, apply some dynamic QoS
policies, there's a whole bunch of things that that authentication server
could tell that authenticator to do.
But if we're just thinking about things for real simply, the main thing
that the access point that authenticator is gonna be looking for is that
master session key.
Now he's not gonna keep it from, he is gonna keep it for himself, but
he's also gonna pass his whole message on to the supplicant.
So both the supplicant and the authenticator need that master session
key. Now, why do they need it?
That takes us to our next message, our next slide here.
So RC 5247, which defines all of these EAP processes, because remember
EAP, the EAP framework was developed before Wi-Fi.
So it was not developed for Wi-Fi, to sort of commandeered it and said,
we can use that, but it's a standalone thing.
There's a lot of other things that can use EAP as well, and it's defined
in that particular RFC, if you ever wish to look at that.
So RFC 5247 says, hey, look, if you're using the full 802.1x framework,
with these devices and everything, then the end result of a successful
EAP-Packet exchange, will be the creation of a master session key.
It says it'll be created by the radius server, otherwise known as the
EAP authentication server.
It's gonna be pretty big, 512 bits in length.
So 64 bytes, that's in length, and that's gonna be important here in just
a second, when we look at the next key that's created, and it's sent to
the sub-locate and the wireless LAN controller.
Now, in this particular case, now I said how I mentioned wireless LAN
controller here.
So in the previous picture, we were kind of looking at an autonomous access
point. There was no controller in that image.
The access point absolutely has to have that master session key.
So it's even though it's not mentioned here in this bullet point, the
end user, tablet smartphone, and the access point have to have that master
session key. Now, if there is a wireless LAN controller involved, if this
is a managed wireless situation, the wireless LAN controller will also
get a copy of that master session key.
He will actually be the first one to get that access accept message in
the EAP-PACKET message, because he's even before the access point on the
wired side. So he will get directly from the radius server, he'll copy
the master session key out of it, he'll forward to the access point, the
access point will copy the master session key, he will then convert into
a wifi frame, send it wirelessly to the sub-locate, and the sub-locate
will capture the master session key.
Okay, so when you're doing 802.1x, that is the very first key, right?
That's the very first key, and you're only gonna get that if you successfully
authenticate. Now, if you're doing WPA Personal, like WPA2 or WPA3, there
is no master session key, and I talked about that in a previous video,
how if we go back to this picture right here, when you're doing WPA Personal,
these messages don't exist, there is no EAP-over-LAN start, there is no
EAP-over-LAN packet exchanges, we just completely bypass that, we skip
the whole master session key, and we go right to creating the next key
in the chain, which is the pairwise master key.
So, master session key, only gonna be there if there's 802.1x and WPA
Enterprise, but the pairwise master key will always be there, whether
you're an enterprise or personal, you have to have a pairwise master key.
So, this was defined in the 802.11i specification, so the pairwise master
key, how it can come into being, how it can be derived is three particular
places. So, if you are doing WPA Enterprise, then it's actually very simply
just the first half of that master session key.
So, we take those 64 bytes of the master session key, cut it in half,
and the first 32 bytes on the front end, we just repurpose that as the
pairwise master key.
Well, what if you're not doing WPA Enterprise?
Well, if you're doing WPA2 personal or WPA3-SAE, which is another way
of saying WPA3 personal, then how do we get those 32 bytes?
Well, in that case, if it's WPA2 personal, WPA2, we take that pre-shared
key like INE is great, or Cisco 123, or whatever your passphrase is for
your wireless LAN, we run that through a very sort of simple formula,
which I'll show you in a subsequent video, and then voila, we end up creating
the pairwise master key as a result of that formula.
If you're talking about WPA3, then there's a whole different process,
a whole different much more complicated process, which is called the SAE
handshake. We'll talk about that in a subsequent video, but the end result
of the SAE handshake is that we now have our pairwise master key.
So, you can come from three different places as you can see right there.
So, just like the master session key was used if it existed between the
access point and the client, and how is it used?
Well, it's basically just used to take the first half of it and turn into
the pairwise master key.
That was pretty much all we did with it.
That was the only purpose of the master session key.
But once the pairwise master key is used, it is created, it is also used
by the same two devices, the client and the access point, and guess what?
If there's a wireless LAN controller involved, it will also create the
same pairwise master key.
And the reason why the wireless LAN controller needs to have that is for
roaming purposes.
Now, this whole course here does not deal with roaming.
If you're interested in roaming, I'd check out the course I created before
this, which is called getting there with wireless roaming, and I go into
all the great details about how roaming works.
But just as a little preview of that, if you roam from one access point
to the other, you want that roaming to be as quick and seamless as possible.
Now, if you're using 802.1x WPA Enterprise, normally that would mean when
I move from one access point to the other and I roam, when I go to the
new access point, I have to do that whole 802.1x exchange again, all those
EAP Overland packet messages, which there could be a lot, depending on
my EAP method, I have to do all that again with the backend server, get
a whole new master session key and then derive a pairwise master key.
Wouldn't it be nice if I could take the first pairwise master key that
I derive from my first master session key and just sort of like carry
that with me when I move on to the next access point?
Well, the only way that can happen is if all the access points that you
could associate to somehow learn or know about that pairwise master key
that was developed the first time you connected that wireless LAN.
And if the wireless LAN controller who's controlling all those access
points has that pairwise master key, he can hand it off to other access
points that you roam to, making the roaming process a lot faster.
That's all I'm gonna say about that.
Okay, so the pairwise master key, you might say, oh great, now that I've
got that, that 32 byte key, I can start encrypting and decrypting things,
right? No, it's not used for that.
This is just another key that we're gonna run into another formula, we're
gonna run it through another algorithm and we're gonna end up creating
some other keys.
So it's a root for the session key creation.
So the pairwise master key and the master session key as it says here
are very secret and thus they're kept hidden from any show commands.
When I was first learning about this stuff, one of the first questions
that came to my mind was, is there a way I can dig into my MacBook and
actually see the pairwise master key or if I did 802.1x, the master session
key stored in there somewhere from my wireless LAN that I'm connected
to? Or could I get into the backend of my 9800 wireless LAN controller
somehow and see the pairwise master key it has for all the wireless LAN
clients are associated?
Well, they are in there somewhere, but you can't get to them, you can't
see them. There's no show commands or anything where you can see that
stuff. They are really down, down deep and they're very hidden because
of that. So before we move on here, one takeaway I want you to have from
this is that the robust security network defined in 802.11i says that
there's keys which will then derive other keys which will then derive
other keys. So it's a multi-step process of deriving keys.
And I talked in a previous video that the whole purpose of that is to
make the keys as complex as possible so that malicious actors can't figure
out what they are, hack them and replicate them.
That's why we go through this.
So we can think of it this way.
There's really sort of in an 802.1x environment, the steps you would look
at are, number one, get your master session key.
That's step number one.
Number two, cut it in half and take the first half and sort of rename
that as the pairwise master key.
That's step number two.
And step number three is we have to then take that pairwise master key
and divide it. And then actually we're gonna take the pairwise master
key and convert it into another key called the pairwise transient key.
We're gonna look at that in the next slide.
So we got master session key only if we're doing 802.1x, pairwise master
key in all implementations of WPA.
Pairwise master key then derives the pairwise transient key.
And then when we got the pairwise transient key, then we take that and
we split it into three pieces.
And those are three final keys that we can use to do our encryption, our
data integrity and all of that.
So it's that multi-step process.
Okay, so now we've got the pairwise master key.
And one other thing I'll talk about about this is that in WPA2, personal,
WPA2, personal, where everybody's connecting to the wireless LAN with
the exact same passphrase like coffee is good or INE123, right?
Everybody's using the same passphrase.
In WPA2, personal, everybody will end up having the exact same pairwise
master key. And that's one of the reasons why we don't want to use that
to encrypt and decrypt data.
Otherwise, everybody in the wireless LAN could see everybody else's stuff.
And we don't want that.
So remember, the whole goal of the robust security network is that every
person connected to the access point should have their own unique set
of pairwise keys that's just for them.
So in WPA2, we absolutely need to take the next step of converting this
into another key that's unique just for that person and their access point.
Now, in WPA3, when I get into the details of that, we will actually see
that the pairwise master key itself is unique.
So even in a WPA3 wireless LAN, yes, you and Bob and Sally who are sitting
next to you, you might all be joining that wireless LAN with the exact
same passphrase like coffee123, but the formula, the algorithm that converts
that into your pairwise master key has a unique way of making sure that
the pairwise master key that's derived for you is unique than the one
for Bob and for Sally.
That's one thing that makes WPA3 so much stronger and more secure than
WPA2. Okay, but now we have our pairwise master key, it's been derived.
And so now the next thing is we need to derive the pairwise transient
key. Okay, so once the access point in the wireless LAN client obtained
their pairwise master key, then they're gonna go through the four way
EAP over LAN dash key handshake.
So if you recall from the picture I had previously that the robust security
network dictates that regardless of what form of wireless LAN you're doing,
whether it's enterprise or personal, you always have to do a four way
handshake at the very end of your authentication, which is called the
EAP over LAN four way handshake.
And the EAP over LAN frame type is called EAP over LAN key messages.
So during that handshake as those four messages are exchanged, the pairwise
transient key will be derived.
So there's gonna be information exchanged between you and the access point
that's unique just for this session that's gonna help a unique pairwise
transient key to be derived as a result of that handshake.
Now, technically speaking, although I don't think you'd ever be tested
on this, the pairwise transient key is called a derived key vector.
Why do we call that?
Well, number one is derived because we had to exchange some material,
some key material during that EAP over LAN handshake in order to derive
this pairwise transient key.
So the pairwise transient key, part of it was derived from the pairwise
master key. That's why we had to have the PMK to begin with, but there
was other pieces of stuff that was fed into the formula in addition to
the PMK, which resulted in a unique PTK that's used for this particular
session. So it's derived.
And we call it a key vector because the pairwise transient key once it's
developed, we basically just split it into three pieces and that gives
us three different subkeys.
Just like an analogy, it's just like in 802.1x when you got the master
session key and we divided it into two and the first half was considered
the pairwise master key.
Same type of things happening here.
Once the pairwise transient key is developed, we're gonna split it into
thirds and like the sort of picture here shows you and each one of those
thirds is gonna be used for something.
So once again, just like the pairwise master key was not used to actually
encrypt or decrypt data, similarly, the pairwise transient key is also
not used to encrypt or decrypt data.
It's just one final key that was derived so then we can finally derive
our last keys. And that's what we're gonna talk about right here.
So once your PTK is derived, real simple, all your complex formulas are
done, all your complex algorithms are finished, all you gotta do is split
it into three pieces.
So the first piece is gonna be called the key confirmation key, the K
-C-K. So this is not used to encrypt anything, this is used to provide
your message integrity.
So for example, if I'm a tablet and I am uploading to my access point,
a wireless frame that contains some very important data like maybe some
bank account I'm depositing into or something, I wanna make sure there's
no possible way that somebody could intercept that frame before it gets
to the access point, change some of the bits and then forward it onto
the access point as like an invisible interloper in the middle.
I wanna prevent those bits from being modified or changed in transit,
how do I do that?
Well, I take those bits and I run them through the key confirmation key.
And the key confirmation key adds to my wireless frame something called
a message integrity code, a MIC message integrity code.
If you're familiar with Ethernet, you know that the end of the Ethernet
frame, what do we have?
We have the FCS, right?
The frame checksum, sometimes called the frame check sequence.
The purpose of the FCS is to provide error detection, right?
The FCS can help you detect if any of the bits in the Ethernet frame were
changed in transit.
Now, it can't help you figure out what was changed, you can't fix the
frame, but you can detect if the frame was messed up in some way.
That's the same purpose of a MIC.
A MIC serves the exact same purpose.
In this particular case, the key confirmation key is used in conjunction
with a formula and your data to create this MIC.
So that's one of the pieces of the PTK.
Then we have the key encryption key, which wraps keys at the access point
send. So we're gonna see here in just a little bit that the access point
itself is gonna create a special key that it generates itself and sends
to all the clients.
And we're gonna talk about what that is.
But when the access point sends that key to you and Sally and Bob and
all these other tablets and smartphones are connected, we wanna protect
that key. We wanna encrypt the key that it's sending.
So the key encryption key is used for that.
And then lastly, probably the one we're most interested in is the TK,
the temporal key.
This is actually the one that encrypts and decrypts unicast data frames.
So just sort of as a recap here, notice we've got three stations, right?
Three wireless client station, one, two and three.
And each one, this case has a unique temporal key.
So we got temporal key key of XX, YY and ZZ for the respective three stations.
And remember, each one of these temporal keys uses one third of the pairwise
transient key that these stations developed.
And those also that their access point has a database here where it's
keeping track of all the stations are connected as well as what the individual
temporal keys are for each one of those stations.
So whenever those stations send anything to the access point, so this
is upstream now from station to access point, all that data will be encrypted
by the temporal key.
And then the access point will decrypt it using the temporal key before
it either forwards it on to the wireless LAN controller or forwards it
directly onto the distribution system.
All right, and whenever the access point used to send unicast data downstream
to the clients, that will also be encrypted via the temporal key.
Now, notice I'm highlighting here unicast data.
Why is this? Well, because there are certain times when the access point
may need to sort of flood the wireless LAN with broadcast and multicast
information. For example, what if the access point needs to ARP for somebody
on the wireless LAN?
Or maybe there's a switch, a wired switch behind the access point that
needs to ARP for one of the wireless LAN clients?
Well, that's gonna go out as a broadcast.
We also have other things like multicast DNS and multicast audio and video
that have to be flooded to all the clients on the wireless LAN.
Well, we also want that to be encrypted.
We wanna protect that traffic.
You can't use the temporal key to do that because the temporal key is
a pairwise key. It's only good for one particular client.
So if you're gonna take one frame and send it out as a broadcast, how
are you going to encrypt that?
Well, you're going to encrypt that by using a different key that the access
point himself creates.
So the access point, when it very first boots up, is gonna create something
called a group master key, derived only by the access point.
And it's 256 bits, that's how long it is.
It's typically created once when the access point boots up.
But some access points have a way, can possibly change this up over time.
But typically it's just derived once.
Now the group master key will then be used inside of a pseudo random function.
You're gonna see that a lot.
PRF pseudo random function.
So this basically just means I'm taking some input, some numbers input,
and my pseudo random function will create some output that is randomized.
So if I take that same number again in the future and run into the same
pseudo random function, I will get a different random output.
That's what pseudo random functions do.
So it's gonna take that group master key, input, I put that into the pseudo
random function, and it will derive a group temporal key, a GTK.
And the GTK is what's used, as you can see here, to encrypt those downstream,
multicast, and broadcast streams, that the access point needs to send
to the wireless LAN clients.
Now once that group temporal key is derived, we don't just wanna send
it to the wireless LAN clients in the air unencrypted, because then somebody
who's just passively sniffing the wireless LAN could see it.
And then they'll be able to decode all the broadcast and multicast at
the access point ascending.
So we need to securely transmit that down to the clients.
How are we gonna do that?
Well, that's gonna be done using the key encryption key that each client
had. So if I go back here real quickly, let's just go back to the previous
slide right here.
Remember, the key encryption key, that's the one in the middle, that is
one third of the pairwise transient key.
So the way this is gonna work is once the access point boots up, it creates
a group master key very, very quickly.
And then within like seconds, it creates a group temporal key.
Was it called group temporal or group?
Yes, group temporal, the GTK.
Now it's got that GTK.
Now a few minutes or a few hours later, you associate to that access point,
right? You join the wireless LAN.
The EAP over LAN four way exchange happens.
During that EAP over LAN four way exchange, you and the access point come
up with a shared pairwise transient key that we see right here.
You both have it.
You both divide that into three pieces.
And this is just for you, just for your session.
One of those pieces being the key encryption key.
Now that four way EAP over LAN handshake isn't done yet.
In message number three, which is the message from the access point to
you. All right, so in the third message of the EAP over LAN handshake,
the access point will take that group temporal key and it will encrypt
it with the key encryption key and send it to you.
And now you've got that particular key so you can decrypt any broadcast
or multicast frames that the access point sends you later on in time.
So every single person that joins the access point, this is why they need
to derive a key encryption key, which is one third of that pairwise transient
because if they didn't have that, they wouldn't be able to receive the
group temporal key that the access point needs to give them.
And so here we can see is a sniffer trace and I'm highlighting the sniffer
trace message number three.
There's the four way EAP over LAN handshake.
So this is called M3 or message number three.
And you can see down there, it says the type is 802.1x.
So 0x888E, that's for all E-frames or given that ether type value.
And down at the very bottom, we see WPA key data.
Now we can't really tell what that is because it's encrypted.
This is encrypted using the key encryption key, but I can tell you in
there is the group temporal key.
It's included in that output right there.
All right, so that concludes that particular video.
Thank you so much for watching and I really hope it was helpful for you.