Hello and welcome to this video titled introduction to SAE simultaneous
authentication of equals.
So in this video, we're going to start getting into the details of how
WPA3 comes up with unique values in a different way than WPA2.
Now let's do a quick review of some of the key concepts.
First of all, remember that a PMK stands for pairwise master key.
Recall that secure Wi-Fi according to the robust security network architecture
of 802.11i requires the use of several keys.
The pairwise master key being a fundamental base key that you typically
start with. And then other encryption and integrity keys such as the key
encryption key and the temporal key are derived ultimately from the PMK
with an intermediary step in between.
So how do we get that pairwise master key?
Well, we talked about in some previous videos that can come from one of
two places. If you're doing a full 802 .1x exchange with WPA enterprise,
then the radius authentication server will give you a big long master
session key. You'll divide that in half and the first half you will rename
or reuse as the pairwise master key.
If you're doing WPA personal, then we're going to take that WPA passphrase
or pre-shared key of whatever it is for your wireless LAN.
And we're going to run that through some sort of a formula which will
then derive the pairwise master key.
Ultimately, however we get to it, the pairwise master key is then shared
between the Wi-Fi client and the access point.
And then we derive subsequent keys from it.
Now, as a review in WPA2 personal, the pairwise master key was derived
by taking your pre-shared key, your WPA2 pre-shared key like that you
had on the wall somewhere or that you sent everybody in an email like
our Wi-Fi password is Cisco123.
Our Wi-Fi password is coffee is great.
Whatever that Wi-Fi password is in WPA2, that along with the SSID uses
what was called a salt was fed into the password-based key derivation
function to the PBKDF2.
Now, the problem with this was a couple of things.
Number one, it was crackable.
People started out with a real sort of easy, simplistic, easy to guess
Wi-Fi passphrase, people could figure out what that was.
If they were able to see the four-way EPUV or LAN handshake when any particular
client was joining the wireless LAN, they could reverse engineer it because
the PBKDF2 function is reverse-engineerable and they could figure out
what that passphrase was.
Another downside was it resulted in the same pairwise master key for each
WPA2 client. So, there was some big downside to it.
So, when WPA3 was being developed, they said, we need to do something
about this. We need to fix this.
So, in WPA3 personal, also known as WPA3SAE, they said, we're going to
get rid of that PBKDF2 function and we're going to replace it with the
simultaneous authentication of equals handshake called an SAE handshake.
Now, this is also known as the dragonfly handshake.
So, you'll see those two mixed interchangeably.
So, how does this really change things?
Well, the big difference here and we'll go more into the math of this
in a separate video is that during the actual authentication stage, you
use a Diffie-Hellman style, not exactly Diffie-Hellman, but very close
to that in theory, key exchange to create unique pairwise master keys
per client. So, the idea here is that with WPA2 personal, every station
connected to the wireless LAN, regardless of what it was, started out
with the exact same pairwise master key.
This is WPA2 personal.
In WPA3 personal, we use a different formula called SAE, which results
in every station having a unique pairwise master key.
So, how do we actually see this?
Well, in WPA3, the simultaneous authentication of equals process actually
changes the 802.11 authentication frames in a couple of ways.
Number one, recall that in regular 802.11, whether you're doing WPA or
WPA2, if you're doing a wire shark sniffer trace of things, you might
see a whole bunch of beacons and then you might see a wireless LAN client
send out a probe request, get a probe response back, and then what would
you see next? You would see one 802 .11 management frame called, actually
it may be it's a control frame.
Anyway, an 802.11 frame called authentication go from the client to the
access point and it would be called an open authentication.
So, the actual type code in there would be a value for open and then you'd
see an 802.11 authentication message go from the access point to the client
and then you'd be done with that.
Then you'd move on to your exchange of association frames, right?
So, this it would just be this one two exchange of authentication, but
the authentication frames really didn't do anything.
They didn't exchange any passwords they weren't really used for authentication,
not with with open authentication anyway.
So, with WPA3, they said we're going to change this a little bit.
First of all, in the authentication frame, we're going to change the authentication
algorithm type from open to SAE.
So, there's now a new authentication algorithm type of SAE identified
with a value of three that you can see here.
And instead of just doing a one two exchange of authentication messages,
we're going to do a four message exchange, two messages from the client
to the access point, two messages from the client.
So, there are SAE commit frames.
So, the way you'll see this in a wire shark sniffer trace, which you'll
see in a moment, is that the client, the very first authentication message
it will send is an SAE commit.
The access point will respond with its own SAE commit.
Then you'll see the client send an SAE confirm and the access point will
respond with its own SAE confirm, total of four messages.
So, the SAE commit frame, so this one two exchange of SAE commit frames
is used to exchange data and random values between the access point and
the client, so they can come up with a shared secret key using a formula
very similar to the Diffie -Hellman formula.
So, once that one two exchange of SAE commit frames is done, they've got
the shared secret key.
And then they do a one two exchange of SAE confirm frames just to confirm
that, to confirm that they really do have the shared, the same shared
secret key. Once that's confirmed, they can then take that shared secret
key, put it into a formula and derive the pairwise master key.
And we'll go through the the gory details of how that works in a subsequent
video. But I just want to finish this video off here by showing you a
sniffer trace from Wire Shark that actually demonstrates this.
And see, here's the main takeaway is that you're no longer seeing just
two authentication frames.
So in WPA and WPA2, you would have seen two, one from the client, run
from the access point, and that's it.
And if you clicked on it, there'd really be nothing in there.
We'd just say open authentication, but there wouldn't be really much of
anything else in there with WPA3 personal, you now see four of them.
And for example, if we click on this very first one here from the client
going to the Cisco access point, you can see SAE message type is commit.
So this is our very first commit message.
So we have two commits and two confirms.
And we'll dig more into the details of how all this works in a subsequent
video. But this is sort of our first overview or intro of how SAE is fundamentally
different in the types and quantities of messages that it sends as compared
to WPA2. Thank you so much for watching this video.
And I really hope it was helpful for you.