Hello and welcome this video titled HNP and H2E.
So let's start by cutting right to the chase and then if you're still
interested you can keep along with me to get more of the gory details.
So here we have the output of a Cisco Calist 9800 Wireless LAN controller
specifically the section where you are either creating or editing an existing
wireless LAN and you're dealing with a WPA3 wireless LAN that's using
SAE. So this is not enterprise this is a WPA3 personal and you notice
down there in the bottom right there is a drop down box called the SAE
password element giving you the three options you see here both H2E and
HNP hash to element only and hunting and pecking only.
So before I go into the gory details here let me just break it down real
quickly. So ideally you would select hash to element only that's the newest
most secure method of coming up with a password element that SAE requires.
However, a lot of older access points and clients don't support hash to
element and you may end up with some buggy behavior if you support that.
Also if you select both H2E and HNP you might still get some buggy behavior
and some clients that are unable to connect if you're using older access
points or older clients.
So it's probably safest to select the older method of hunting and pecking
only you will guarantee be able to have your clients connect to the wireless
LAN if you select that.
Okay now that I've mentioned that let's go into the details of what is
hunting and pecking what is H2E and how do they work and overall why is
H2E better than hunting and pecking.
Now to start with that discussion we have to first talk really to high
level about something called elliptic curves.
Now elliptic curves go into a lot of gory very detailed math.
I'm not a mathematician so I'm not going to go anywhere even close to
that I'm just going to skim this at like a 50,000 foot level.
So starting out with if you just think about a general curve in the first
place like you would graph it on a graphing paper or something we know
that curves are made up of an infinite quantity of points and each point
on a curve is represented by two values and x value which represents where
that point is on the horizontal line and a y value that represents a value
of where that is on the vertical axis okay.
So all curves have an infinite amount of points that can be represented
each point in that way.
Now when it comes to elliptic curves elliptic curves although if you look
them up in documentations and papers in Google a lot of times they'll
show shapes like this right here.
In reality an elliptic curve is not really a two-dimensional object it's
a mathematical formula and it's a mathematical formula in which the x
and the y coordinates the values for the x and y have to follow very specific
equations they have to adhere to an equation and if an x or y coordinate
does not meet a particular formula then it does not belong on an elliptic
curve okay so let's go a little bit more detailed into that some of the
elliptic curve math.
So in WPA3SAE we need to submit messages that's the whole point of that
the the SAE commit messages have to well actually they have to exchange
they have to create a shared secret.
So in SAE we start out with exchanging some information in the commit
messages that ends up resulting in a shared secret we then exchange some
confirm messages to confirm that the client and the access point actually
do have the same shared secret once that's confirmed then we can use a
other a little bit more math to convert that shared secret into a pairwise
master key and then it proceeds on from there during the EAP over land
four-way exchange to come up with the transient key the key encryption
key and other things.
So everything starts with the shared secret we have to derive that first.
So there's lots of mathematical inputs and formulas used to come up with
that shared secret one of the inputs is something called the password
element. So the password element is derived in SAE using the elliptic
curve diffihelmin formula so that's the basis for coming up with the password
element and there are different formulas for elliptic curve diffihelmin
just like if you're doing regular diffihelmin if you're doing regular
diffihelmin one of the like for example for an ipsec VPN or something
like that to come up with a shared secret key at the very beginning when
you're doing like the iC authentication or something in regular diffihelmin
the first thing you and your peer have to agree on is the diffihelmin
group you're going to use and those groups are numbered like diffihelmin
group five diffihelmin group 14 and each diffihelmin group when you agree
on the group you're agreeing on a set of shared parameters like one group
and its equation might use a certain prime number that's really big another
group might use a different prime number that's even bigger and so there's
some shared values that each group adheres to so the same thing is true
when we're doing elliptic curve diffihelmin we have to agree on the elliptic
curve diffihelmin group we're going to use and whatever group we use will
dictate what formula the points on the curve have to adhere to so for
example here's an example of the group 19 otherwise known as NIST P256
that's actually used by WPA3 SAE this is the formula and i'll go into
a little bit more details about this formula right here but at a high
level the takeaway is is that if i give a number to represent the x coordinate
well if i go through this formula okay and then at the end of it if whatever
the result of this thing on the right is is the same thing as some number
squared so if the result on the right x to the 3 plus ax plus b mod p
if that whole thing ends up being some value that's a square of something
else then i've got my y coordinate and that means that the x and the y
formula so for two values representing x and y to be considered a valid
elliptic curve point they must adhere to the formula now just to break
this down a little bit more in case you're a little bit interested in
the math here i was wondering well what is you know if i supply a value
of x that's great but i have to also know what a and b and p are in order
in order to do this formula here on the right so you can see here um in
this picture this tells you a little bit more about this go ahead and
feel free to pause this video if you're curious about this but you can
see p a and b are these fixed numbers these fixed values that come with
group 19 and then you would apply these against whatever value of x you
come up with and then at the end of the day if everything on the right
here comes up with the value that that you can that's the square of something
now you have your y coordinate so just to restate wpa3sae must first derive
a password element before performing the sae exchange this has to happen
before the very first commit message is even sent and the password element
is going to be a value and it's going to be a valid point on the agreed
so the password element is actually going to be a number that somehow
incorporates both the x and the y now it's far too detailed in math for
me to explain to you how to two numbers one representing an x coordinate
and one representing a y coordinate how do we convert those two numbers
into a single thing that we can use as our password element but it does
it so elliptic curve diffi helman somehow figures that out so just know
that that is what the password element is the password element represents
those two points on the line that meet the elliptic curve formula so let's
just give sort of like a real simplistic example of how this works now
this is not how ecd h works or sae e this is just giving sort of a real
sort of high level of sort of the mechanics of this so imagine if we use
a real simple formula for our elliptic curve diffi helman group let's
say it was y squared equals x minus one and so i need to come up with
a value of x that if i take that value of x minus one it will equal something
that is squared and then i'll have my two points okay so we know that
in wp three sae there are inputs that go into this formula to come up
with the value of x those inputs being at minimum the s sid and the passphrase
as well as a couple of other things as well but we're trying to keep it
real simple here so the re i'm using an s sid of ace and a passphrase
of b 55 for very simple reason because i want to convert each one of those
characters into an aske value because remember at the end of the day sae
is taking your s sid of coffee one two three and your passphrase of best
coffee ever and somehow converting that into a numerical number to plug
into this formula so i just chose an s sid in a passphrase that's real
easy to turn into numbers so a is 65 and aske c is 67 and e is 69 so if
i took let's say my formula at took those three numbers add them together
and i get 201 and then i do the same thing for my passphrase b is 66 five
is 53 five again is 53 these are the aske values for these characters
take those and together i get 172 now if the formula said okay now that
you've done that add those together to get one number see so what i'm
doing right here is providing a real simplistic example of one way in
theory that we could take these things that you typed in your s sid in
your passphrase and convert them into one number one string of numbers
now this is not how sae does it i'm just giving you sort of an idea of
oh here's how it could happen so now that we've got that we need to figure
out if there's if we could plug this into a formula and if this could
be a valid elliptic curve point so is it possible that 373 could represent
x on our formula well let's take it and if it's not what do we do about
that well what if we did this how do i change 373 into a suitable value
for x that will satisfy the equation let's try hashing it here's an example
let's try this so what if we take the hash of 373 and let's say the first
time we do it we get the value of 501 okay will that work 501 minus 1
is 500 is there some value that if that value were squared would equal
500 no i don't think so so that can't possibly be a valid elliptical curve
point all right let's do attempt number two what if the formula said let's
take the result of 501 and hash that and maybe the result of that hash
is 207 all right check it again 207 minus 1 that's 206 is 206 y squared
could we come up with y if y squared equal 206 no we couldn't that wouldn't
give us a valid y number what about attempt number three oh look at this
so if we take our value our previous value of 207 hash it again now we
come up with 145 oh look at this 145 minus 1 is 144 guess what 12 squared
equals 144 so now we can say well if x is 145 then y could be 12 and now
we have two points that match our elliptic curve formula and now if we
could somehow combine those two things into a single value we would have
our password element so you can see in this sort of high level theoretical
example we're using hashing and we're doing multiple attempts to come
up with a value that will satisfy this value of x in this formula and
we started out with some values that were typed in by you the s s i d
in the passphrase to to do all of this all right so how does wpa3 sae
actually do it so we know that we have to perform a password element we
know that we're going to be doing this using elliptic curve diffie helman
and there are two ways that this can be done and this goes back to that
picture that we saw of the 9800 controller at the beginning of this video
one method is called hash to element the other method is called hunting
and pecking now here's the critical ingredient whichever one you select
it has to be done by both the client and the access point they have to
use the same method in other words if the client is coming up with his
password element using hash to element and yet the access point is taking
the same inputs that passphrase and s s i d but he is using hunting and
pecking it won't work and the client will not be able to associate to
that access point and that's what we get right here so this is where we
have to choose now if you leave this box alone you don't select anything
it will default to both h2e and hnp and i will tell you that if you're
using an access point that's oh that was manufactured within probably
the last couple of years that should be fine but where you might run into
trouble is if you're using an older access point that so three four five
years older older then leaving it the defaults here is going to cause
you some odd behavior and i'll actually show you some examples of that
in the subsequent video after this one so let's start out with hunting
and pecking historically this is the one that came out first so when wpa
three first was invented you know by the Wi-Fi alliance and they said
oh wpa three needs to go through this sa exchange but before we do that
we need to come up with a password element and they said hmm how are we
going to do that how are we going to take a passphrase and s s i d and
maybe a MAC address and a couple of other things and come up with a number
that we can use as a possible x-coordinate to feed into our formula to
see if it works and so this is the way they came up with it first hunting
and pecking so how's it work it actually works kind of like what i did
in my previous high level example it uses a hashing mechanism to convert
the passphrase the s s i d and a few other things to a point on the curve
kind of like what i did previously in my example now very good chance
at the first time it hashes it and comes up with the value and it plugs
that value into the formula that we saw with that big a and p and b values
and x to the three and everything it probably won't work it probably won't
come up with a value that satisfies y on the left side so we will have
to do it again now the way that hunting and pecking works it says okay
the first so what i'm going to do is i'm going to take my inputs of my
static inputs of passphrase s s i d MAC address maybe one or two other
things and i'm going to add to that something called a counter maybe start
out with a counter value of one and i'm going to hash all that and then
see if the result is something that's a valid x coordinate if that doesn't
work i'll keep all my normal inputs the same i'm certainly not going to
use a different passphrase or a different s s i d all that's going to
remain the same i'm just going to increase the counter and now because
that one little changes happened i'll hash it again and that will come
up with a different hash result that i can test now as you can see here
it's going to thousands or even millions of times until it hashes to a
value that actually does work in that group 19 egaliptic curve diffi helman
formula and then we've got our x number which translates to a y number
so potentially many iterations and weaker security now why they say weaker
security here is because there's a trade -off here we know that in general
in security whenever you're dealing with a password or a passphrase you
know what's the general recommendation make it really long and something
that people can't guess right so the same thing is true here when you're
setting up your wpa3 sae wireless LAN you're gonna have to go into the
controller or the access point and type in what the passphrase is that
you're going to give to everybody else well here's the problem if you
give it a really short easy-term memorized password like coffee is great
or something something short like that well on the on the pro on the upside
that's easy for all the people at your store whatever to see on the wall
and type into their phones or their tablets right and then if you're using
and hunting and pecking the shorter the password the less hashing iterations
it will have to do until it finally comes up with a valid x-coordinate
maybe it only has to hash coffee is great like 5,000 times before it finds
an x-coordinate but that's not so good so what if we're talking about
a company right where you're not posting the passphrase on the wall you
don't want people outside the walls of your company gaining access to
your Wi-Fi so you you know email all of your new employees or you give
your new employees you know a card or something that's got the passphrase
on it or maybe you do it for yourself on their laptop before you hand
it out to them as a company owned asset either way the poll point is we
don't want outsiders to know what that passphrase is because we don't
want to get them on our Wi-Fi they don't belong there so we say well we
should probably have a really long passphrase then well the longer your
passphrase is the more iterations of hashing hunting and pecking is going
to go through and it can actually be very computationally expensive on
the smartphone and the laptop to go through these possibly millions of
iterations of hunting and pecking for a long complex Wi-Fi password before
it finally finds that x-coordinate that's going to use to fill into the
formula and so that's one of the downsides is hey i'm trying to do what
they tell me to do i'm trying to come up with a really long passphrase
but it's computationally expensive and it's causing my CPU to overheat
because hunting and pecking is having to go through millions and millions
of hashes to finally work and the other downside of hunting and pecking
that they say is that you know if somebody on the outside is sniffing
your wireless traffic right and their goal is to either get on to your
Wi-Fi or they want to you know crack the cryptography so they can decrypt
people's frames whatever their malicious goal is the objective is we want
to give them as little information as possible we want to prevent them
from guessing anything about what's going on in the Wi-Fi so with this
method here if i if somebody is Wi-Fi had a really short simple passphrase
and i was sniffing okay and i was actually seeing like you could you could
measure the time when the client first sends its commit message when this
client sends its commit message the client has already generated a password
element so it's already gone through the hashing and stuff but the access
point hasn't yet because until the client sends the message the access
point is not going to know what diffie helman or i should say elliptic
curve diffie helman group that client wants to use because there's more
than one so the access point can't generate its password element until
it sees that commit message from the client and it knows what group that
client is using so if i was watching everything on the outside and i was
doing a stiffer trace i could actually see hmm it looks like i can actually
measure the time and like microseconds or milliseconds between when the
first commit message was seen and then the second commit message from
the access point came back and i might be able to infer based on that
time if that time is really short i can infer that the passphrase they're
using must be something pretty short and simple whereas if the time is
longer then i can for oh that's probably really long complex passphrase
they're using because it's taking a lot longer to come up with that password
element and that's why that second commit message is taking a little bit
longer to go back there are actually some sorts of attacks that use that
as sort of like a basis in their attack so that's another downside of
hunting and pecking now the pro here is that any Wi-Fi client that supports
wpa3 will support this because this was the original way that wpa3 sae
used to come up with that password element but we talked right now about
some of the downsides so later on people developed something called hash
to element this is newer this came out after hunting and pecking and it
uses a cryptographically specified hash to curve algorithm so here's really
the details of this and we don't have to go into any math or anything
for you to take away why this is better why is this better because somehow
in a way that i do not understand this is able to take your inputs of
your passphrase and your SSID and maybe the the MAC address of the client
or the access point and somehow go whoop right there and figure out what
a password element value is that would satisfy that elliptic curve diffi
helman group without doing multiple iterations and saying does this work
nope does that work nope does that oh yeah that one works it somehow bypasses
all that in zips right to the answer i have no idea how that works but
it works so this is more efficient and safer than hunting and pecking
but like i said the problem is some older clients and access points unfortunately
don't support this so as our final takeaways for this particular video
one thing to know is that access points do advertise in their beacons
what password element capability they support in their beacons and probe
responses they actually in their beacons they actually say you know there's
actually if if if they support hash to element there's a special information
element that they insert into the beacons and i'll show you that in a
subsequent slide but to give you a preview right now it's actually dictated
by the IEEE that if a access point supports hash to element it must put
a special information element right after the rsn element right after
the robust security network element they have to put another one in there
that has a little bit set that says i am doing hash to element or at least
it says i can support hash to element that that one little bit if it's
set to one says i'm capable of this and then it leaves it up to the client
to decide whether or not it wants to use hash to element or whether or
not it wants to use hunting and pecking now like it says right here if
wireless clients see that beacons or they see that probe response and
they see that information element in there then most of the time if the
client actually not most of the time all the time it says in the actual
IEEE specs it says if a client sees that bit set to one and the client
supports hash to element it should use hash to element not hunting and
pecking it will only use hunting and pecking if it doesn't see that information
element so it says hmm access point is not indicating that he supports
hash to element in any way i guess i need to use the older method of hunting
and pecking now here's another sort of very important thing to be aware
of if you're using Wi-Fi 6e or Wi-Fi 7 or anything else that might come
out in the future those require hash to element so that is mandatory so
obviously you're going to need a newer access point to support those newer
Wi-Fi standards and they will support h2e just make sure that your clients
also support it now if you're unsure about what the capabilities are of
your access points to your clients just stick with hunting and pecking
and you should be safe so that's it for this video thank you so much for