Hello and welcome to this video titled WPA2, Personal PMK Derivation.
In this video I want to talk a little bit more detail about how the pairwise
master key is derived in WPA2.
And you might be thinking to yourself, well I'm watching this video in
the context of a course on WPA3.
So why do I need to know this?
Well once you understand how the pairwise master key is derived in WPA2
and its relative flaws due to this process, you will appreciate even more
how they fixed it in WPA3 and why the pairwise master key in WPA3 is derived
in a much better, safer way.
But if you didn't know this, you wouldn't really understand why WPA3 is
so much better. So let's look and see how WPA2 does it.
So once again we know that if you're doing WPA enterprise, you have an
authentication server on the back end, a radius server, and that's going
to derive a master session key.
Also as a review, once that master session key is derived, the first half
of that will be renamed as the pairwise master key.
Now we're talking about personal version of WPA, then we don't have a
master session key.
Instead, we use that pre shared key or that passphrase like coffee 123
or I and E456, you know whatever the wireless LAN passphrase is that's
that's staple to the wall for everybody to see, we use that as the basis
for creating our pairwise master key.
Now how it does it in WPA2 is very different than WPA3.
So in WPA2, it uses something called a PBKDF2 key derivation function.
And that's where we're going to focus on on this video.
WPA3 uses a completely different process called the SAE exchange function.
And once you recognize the PBKDF2 function in this video, you'll be able
to appreciate how the SAE exchange function is better.
All right, so let's focus on WPA2 here.
So first of all, PBKDF2, what that is such a crazy long, weird impossible
to remember acronym.
Well, it does actually stand for something, although I'll be honest with
you, I've looked at this thing hundreds of times.
I still don't have it memorized.
So PBKDF2 means password based key derivation function too.
Ah, that makes sense.
Okay. So if you ever want to dig into the guts of this and see the core
details of how it works, you'll it was originally defined in RFC 2898,
and then it was updated in RFC 8018.
So there you go.
If you have a hard time sleeping a night one night.
So here's sort of the basis behind this key derivation function and why
we need it. We know that when you get onto an access point and you configure
a WPA2 personal wireless LAN, or if you're doing this on a controller
like a 9800 controller, either way, you're going to be asked to input
some sort of a pre shared key, some sort of a pass freeze for that wireless
LAN. And that passphrase typically has to be a minimum of eight characters
up to 63 characters in length.
So you've got that that range there from eight to 63.
Obviously the longer your passphrase, the more secure it is.
But here's the deal.
It's giving you this variability, right?
If you want to type in an eight character one, you can.
If you want to type in a 12 character passphrase, fine.
Go ahead and do it.
But the problem is, is that we discover from a previous video that the
pairwise master key always is the same length.
It's 32 bytes in length, right?
32 bytes. So if I have as my input an eight character thing or a 16 character
thing or a 59 character thing, how am I always going to get as a result
the exact same, I should say a fixed length of 32 bytes pairwise master
key. And that is the purpose of the PBK DF2 function is to provide the
sort of like mathematical or algorithm and formula to stretch whatever
the passphrase was that you gave it into a full fledged pairwise master
key. Now how does it work without going too much into the math here, we
start with our pass phrase and then we include a salt.
The salt is basically just the SSID.
So whatever your SSID is, but the PBK DF2 function says include a salt.
And this particular case is salt is the SIS ID.
Then you're going to run that through an HMAC Shaw one function.
And you're going to do this 4096 times.
And each iteration is going to take the result of the previous hash as
input for the next one.
Until you get a 256 bit pairwise master key.
Now, if you're familiar with the HMAC Shaw one function, obviously this
is used for a lot of different things, not just Wi-Fi.
A lot of things use HMAC Shaw one.
So HMAC Shaw one was designed to do is take any variable length input,
like in this case our pass phrase.
And once you shove it into this HMAC Shaw one function, it ends up creating
at the end a fixed length output.
Now, in the case of HMAC Shaw one, that fixed length output is 160 bits,
which is 20 bytes.
Now you might be thinking, but wait a second, Keith, 20 bytes.
You told me that the pairwise master key has to be 32 bytes.
So this is a little short.
Well, that's why this thing is run multiple times.
And and then its outputs are concatenated together.
So basically you might take like two outputs together, which will give
you 40 bytes and then just chop off the eight bytes at the end, leaving
you 32 bytes. And then it will do this over and over and over again.
And the purpose of doing it 4096 times is to make it stronger and stronger
and stronger so that hopefully an attacker will have to use a lot of computational
power if they want to try to reverse engineer this.
So the result is the pairwise master key.
Now, why do we care about this?
So we know that the PDKDF to its whole purpose of being in this case is
to take your variable length WPA to personal passphrase and convert that
at the very end into a 256 bit pairwise master key.
Otherwise knows a 32 byte pairwise master key.
Now here's the problem.
Number one, the iteration count is fixed and Shaw one is relatively fast.
So if you end if you start this whole process with a fairly weak passphrase
like Cisco one two three or password one one one something easily, you
know, guessed with minimal computational power, somebody could actually
take your pairwise master key and then reverse engineer it and figure
out what your wireless LAN passphrase is.
And now they could get access onto your wireless LAN.
Now that would not give them the ability to decrypt your frames though
because keep in mind that even though we have a pairwise master key, we're
still going to have to go through some additional steps to create a pairwise
transient key and then eventually a temporal key.
And every user has their own unique PTK and TK.
But in the world of WPA to because the wireless LAN passphrase is always
the same for everybody.
And the SSID is always the same.
And those are really the only inputs that are used in this system here.
That means everybody's going to end up having the exact same pairwise
master key. So somebody can get a hold of that pairwise master key.
They can reverse engineer it and discover what the original passphrase
is for your wireless LAN.
And now somebody who's not supposed to be on your wireless LAN could get
on your wireless LAN because they have the Wi-Fi passphrase.
So in summary, short or easy to guess PSK's like INE123, coffee is good,
whatever your passphrase is, makes WPA too personal, easy to crack with
offline attacks.
And what we mean by an offline attack here just to not to go too far to
the weeds here. But if I had a wireless sniffer trace going, I'm not part
of the wireless LAN.
Maybe I'm sitting on the parking lot, but even the parking lot with my,
you know, a little antenna sticking out of my window, I can capture all
the Wi-Fi frames on a particular wireless LAN that's on the other side
of the wall of like an office building.
And so I just sit out there for several hours.
Now, and I'm collecting traffic and I'm storing on like a hard drive or
something. Well, as I'm collecting traffic, if I actually capture somebody
who's joining that wireless LAN, so I can actually see their four way
EAP over LAN handshake, if I can get that, I can actually use that with
WPA too personal.
If they started out with a very weak Wi-Fi passphrase, if I can see their
four way handshake, I can run that through an offline dictionary attack
and try to reverse engineer.
So basically a dictionary attack is where you have in your like server,
you've got a dictionary of like 10 million passphrases, maybe stuff that
was stolen off the dark web or something, stuff that was randomly generated,
but you've got like just millions and millions of sample passphrases starting
out with like password one, two, three admin, real easy stuff, but millions
of them. And so when you see their EAP over LAN four way handshake, you
can just take and remember that you've got the SSID because you see it
in the beacons there.
So you take the SSID that you're seeing in the beacon and then you just
start with the first passphrase that you've got in your dictionary, your
offline dictionary, run it through the same PBK DF2 function, see the
resulting output and compare that output with what you see in the EAP
over LAN four way handshake.
And if you do that often enough, you might end up with a match.
And if you end up with a match, you say, ah, the thing I started out with,
which was like number 5000 six in my dictionary, that must be the wireless
LAN passphrase they're using in that wireless LAN.
And now that I know that I can join it, even though I'm not even part
of that company.
So with WPA two, it's susceptible to that.
Now, if you're really curious about what the process is to do that, I
would recommend going into our INE course catalog.
And we have some courses in our cybersecurity section on Wi-Fi cracking.
And we have some videos on there on WPA two cracking and it shows you
how you can do that.
So that's how WPA two comes up with the pairwise master key.
Thank you so much for watching this video.
And I hope it was helpful.