Hello and welcome this video titled WPA3 password element generation.
So WPA3SAE, so we're not talking about the enterprise version of WPA,
the personal version of WPA, uses a simultaneous authentication of equals.
And we've seen in some previous videos that this entails the exchange
of four frames, two SAE commit frames and two SAE confirm frames.
The whole purpose of that is to derive a shared secret value between the
access point and the wireless LAN client.
And then that shared secret value can go through a bit more mathematical
computations to ultimately derive the shared pairwise master key between
the client and the access point.
Now the password element is a critical component of this entire process.
And it is used as one input among several of the math functions that are
used to create that shared secret.
So here we can see the formula used to create that shared secret.
And we can see that the password element is used in four different places.
It's used to derive the finite field element values, otherwise it's called
element values here.
It's also used to derive the shared secret value at the very end.
So PWE is the password element and we can see it's used here.
So this video is going to talk a little bit about how we come up with
that number, the password element.
Now you might be wondering, okay, so why are we going into why we need
to come up with that value?
It just works, right?
I mean, it's not really something I can change or affect or modify in
any way, right? Well, it depends.
On most no autonomous access points, like you have if you have a home
based access point at your house that has its own little web UI and everything,
it probably doesn't give you any control over how the password element
is created. It just is going to work in the background.
But we'll see here it is to moment on enterprise wireless gear, for example,
wireless access points are controlled by a Cisco 9800 wireless and controller.
It will actually give you a little dropdown box that lets you control
the process by which the password element is created.
And if you select a password element method that the access points or
the clients don't support, then you're going to end up with a mismatch
between the password element value that the access point came up with
versus the password element value that the client came up with.
And then the client obviously won't be able to connect to that wireless
LAN. So it's important to understand the two methods available to us to
create this password element so that if you are on gear that gives you
that option, you sort of know what's going on the background and you're
a little bit informed as to maybe which one to select.
All right, so let's go a little bit more detail into this.
So how the password element is created in the first place is that it takes
various inputs, such as the SSID, the client's MAC address, and the access
points MAC address into its derivation.
Each connection between a client and an access point will derive a unique
password element value.
So Bob connecting to the same access point as Sally, Bob's connection
is going to have a different password value password element value than
Sally's connection to the access point.
So the password element is a value map to a point on an elliptic curve.
Now when you server.
One of these brilliant methods is the responsible LinkFor DiffieHellman.
You know that when you're using DiffieHellman, one of the first things
that the two devices have to agree on is the DiffieHellman group they're
going to use. For example, DiffieHellman Group 5, DiffieHellman Group
14 and so on and so forth.
Because each group has two values that come standard as part of that group,
two publicly well known values.
There is a base or generator value.
Okay, so that's the same thing base generator, just different terms for
the same thing that are mapped to that particular DiffieHellman Group
and there is a modulus value, this map to that particular group.
But here when we're talking about elliptic curve DiffieHellman, and that's
what we're really looking at here, is elliptic curve DiffieHellman also
has different group values like group 19 and group 20.
But they rely on this concept of an elliptic curve.
And what's sort of really, and now this is good, we don't want to get
too far into the weeds here because the math gets amazingly complex.
But the idea behind an elliptic curve that's used for DiffieHellman purposes
is that every point on that curve matches a mathematical formula.
For example, let me do that animation again.
Look at this curve here and you'll see some points just randomly placed
on it. Each point has a value for its x coordinate and its y coordinate.
Right, its x axis and its y axis can be mapped to two different points
in x and a y. Well, sort of the unique thing about this particular curve
is that any point that you find on it, if you put those x and y values
into this formula, it will always work.
So y squared will be equal to x to the 3 plus a x plus b.
Now we're not going to get into what is a x and what is b?
Feel free to research that if you want.
But the point is there is a definite relationship between x and y that
is repeatable across all the various points you could find on this curve.
So as far as WPA3SA is concerned, what the goal here is to map the pre
-shared key like INE123 or coffee is good, whatever your wireless LAN passphrases
for WPA3, you take that as an input, the SSID is an input, a few other
things, and then behind the scenes there's some very complex math that
ends up mapping those values to some point on this curve.
So if the access point and the client are taking the exact same sets of
inputs, the WPA3 pre-shared key, the SSID and a couple of other things,
and using the exact same elliptic curve Diffie-Hellman group, they should
come up with the exact same element value, which is related to one of
the points on this curve here.
So you can see here when the client sends its group message, it says,
look, the password element I'm creating is based on elliptic curve Diffie
-Hellman group 19.
See how it says ECP group 19 right here?
So that tells the access point, hey, I need to use that same ECDH group
so that I'm coming up with my password element the exact same way the
client did. Now, like I said, why do we care about this?
Well, we care about this because the actual mechanics of how those values
of like passphrase and SSID are ultimately mapped to a point on that curve
are possibly configurable and there's two ways those could be configured.
There's one called hash to element and another called hunting and pecking.
Now, like I said, a lot of access points are like standalone home access
points won't give you a choice between those two.
In the background, it will just default to one, but on upper end enterprise
gear, you might have a choice between that.
And the point here is that the client and the access point must use the
same method. Here's a screenshot from a Cisco 9800 catalyst wireless LAN
controller. And you can see here as part of configuring your WPA3 wireless
LAN, WPA3 is selected here.
And notice that the authentication key management is SAE, so we're not
using 802.1x here.
And down here under SAE password element, there's a pulldown menu.
And you've got some choices here.
You could select hash to element only.
You could do hunting and pecking only.
Or you could say, let's try both and see which one works.
So in the next video, we're going to talk a little bit more about what
the difference is between the hunting and pecking method versus the hash
to element method.
We're not going to go into the weeds about how they mechanically operate,
but I will show you some buggy behavior that might happen, especially
if you're dealing with access points that don't necessarily support both
of these. So for now, the takeaway from this is that the password element
is a point on an elliptic curve.
How we got that point on the elliptic curve is by using either the hunting
and pecking method or the hash to element method.
And it takes as inputs common values that both the wireless land client
and the access point are aware of, namely the pre-share key and the SSID.
And with that, we will leave it at that for this video.
Thank you so much for watching.
And I hope it was helpful for you.