Hello and welcome to this video titled WPA3 Enhanced Open.
So let's talk about this really fascinating feature of WPA3 by starting
and talking about what the problem is that it solved.
So here's a simple problem.
Have you ever been to a network like in a coffee shop or an airport or
a bookstore or something?
Or maybe you've got some signs posted around about what the wireless LAN
passphrase is and you mistyped it something small.
You didn't realize you mistyped it and you're scratching your head wondering
why am I unable to connect to this thing?
What's going on?
Or maybe you're in a place that doesn't have any signs anywhere.
Maybe they got a little cryptic sign somewhere in the corner, not very
visible or easy to see.
So now you've got to wander around asking somebody, hey, do you know what
your Wi-Fi password is here?
What a pain. Right?
So some people want to be able to connect to networks like that.
Public open Wi-Fi networks.
They don't want to have to type in some big long passphrase, but they
do want their traffic to be encrypted, especially if they go to Uncle
Bob's house. Very important your traffic is encrypted at Uncle Bob's house.
So they want their traffic encrypted, but they don't want to have to find
what the passphrase is, especially if it's some long, complex, weird passphrase
that they on their tiny telephone, they might type it in incorrectly.
They don't want to have to deal with that.
They just want to connect to a network, not type in a passphrase, but
somehow magically have their traffic encrypted so that people on the same
network can't see what they're doing.
So that is the problem.
How do we provide Wi-Fi encryption without a passphrase?
Because up until now, whether we were talking about WPA2 or WPA3 with
SAE, either way, we had a pre-shared key or passphrase that was fundamentally
required to derive this pre -this pairwise master key.
And without a pairwise master key, we couldn't do the EAP over land handshake
and we were done.
No encryption possible.
After all, you got to get to that temporal key, right?
That TK and that TK starts way up with the creation of a pairwise master
key. So how do we create one of those things without some sort of a pre
-shared key or authentication?
And that is what Wi-Fi enhanced open was developed for.
So this was first introduced with WPA3 and it's a security method aimed
at open, no password Wi-Fi networks, but give people the ability to have
encrypted sessions across that.
Now technically speaking, it's called opportunistic wireless encryption.
So that's the mechanism used under the hood of Wi-Fi enhanced open.
And so we're going to have a cryptographic handshake that generates a
unique encryption key between each client and the access point.
And yet the SSID itself, when you look at the beacons, is going to be
advertised as an open SSID, meaning you don't have to type in a passphrase.
So let's look at a high level of how this works.
First of all, the client device will see beacons flying around and the
beacons will say open authentication.
Okay, so and they'll show up in your list there with, you know, without
the padlock saying this is an open authentication wireless LAN.
And so, but there is an information element, a special IE within the beacon
itself that says, Hey, this open wireless LAN supports opportunistic wireless
encryption, OWE.
So assuming that your client supports that feature and most Wi-Fi clients
developed in the last, oh, two, three, four years, they should, then it
will, what will happen is just a one to exchange of 802.11 authentication
frames, just like normal.
Did this say open in the authentication frame?
There's no passphrase or anything there.
And then there'll be your authentication handshake, association request
and association response.
But here's where things get a little bit different.
Normally in an association request and association response, we don't
really sort of think of those frames as having anything to do with authentication.
Normally we think, okay, well, authentication is going to happen afterwards
with the four way E-Bover LAN handshake, not so here.
In this particular case, because the client recognized that this wireless
LAN supports opportunistic wireless encryption, OWE, the client at that
moment, right there when he sees that, that client will, in the background,
you don't have to do anything.
This happens in your phone, your tablet, it will immediately create for
itself a public private key pair, right then on the spot.
And then when it sends its association request frame, it will actually
include some Diffie Hellman information right there in the association
request, including that public key, it generated like a split second ago.
And then the access point will send an association response with its Diffie
Hellman information, its public key, and then just using standard Diffie
Hellman using this public private key and the magic that Diffie Hellman
goes through, both sides will be able to derive a shared secret, which
can then be turned into a pairwise master key, which is ready and waiting
for the next step, which is our standard four way E-Bover LAN handshake.
And all this is done without requiring a password.
And if you later leave disassociate from that network and then come back
at a later time, guess what, your phone, your tablet will create a brand
new public private key pair.
And so because every client on that wireless LAN, you, Bob sitting next
to you, Sally, who's sitting in the next row over, because every client
is going to drive their own unique public private key pair when they join
this OWE wireless LAN.
And this is just what WPA3 does.
Everybody will ultimately derive their own unique temporal key.
So everybody's encryption will be done unique.
Nobody can decrypt anybody else's traffic.
So enhanced open requires support of PMF protected management frames.
But remember, we're talking about WPA3 here.
This is a WPA3 feature.
And if you're going to do a WPA3 wireless LAN, protected management frames
are required. That's part of the standard.
So you're not going to be able to do this without PMF.
So how do you create this?
So a standard OWE wireless LAN, very simple.
So, you know, I'm not showing you the first screen here where you create
the wireless LAN, but for example, let's just go over here in our controller.
So you just do what you normally do.
You would click configure, wireless LANs.
Sometimes this is a little touchy on my side here.
There we go. And then you just add a wireless LAN like you normally do.
So this first stage is no different.
So, you know, if this is at an airport, for example, we might call it
airport guest. Right.
And it would be enabled.
I'm not going to do six gigahertz here.
By the way, OWE is not supported on six gigahertz.
That's going to come up in another slide.
Only support on 2.4 and five gigahertz, not six gigahertz.
And then when I go to the security section, that brings us to what we
were just looking at, which is this right here.
So then you're going to select WPA3.
And then you're going to select for your authentication key management,
OWE right here. And notice that as soon as you click that, watch this.
WPA3. Okay. So let's tell me down here what authentication key management
do you want? Now, if I selected SAE, then I'd have to type down here a
pre shared key, right?
But if I select OWE, all that goes away.
And there is no pre shared key to select because that's not part of OWE.
And then you just apply it.
And then you have your OWE wireless LAN.
So if you capture the beacons from that wireless LAN, this is what you're
going to see down here under your robust security network information
element. A subcategory of authentication key management knows what says.
It doesn't say PSK.
It doesn't say SAE.
It says opportunistic wireless encryption.
So this is how the Wi-Fi clients who support this can recognize this and
say, oh, I can connect to that.
And when the Wi-Fi client, like I said, knows this is from the client
to the Cisco access point, association request.
And like I said, here in the association request, here's your Diffie-Hellman
stuff. So that the client can begin the Diffie-Hellman exchange.
So with this, just one, two exchange of messages, association request,
followed by association response, both sides using Diffie-Hellman will
be able to create a shared secret, which can then be turned into a pairwise
master key. So knows here what's different with SAE, right?
There's several differences with SAE.
So when we were doing a WPA3 SAE wireless LAN, the generator slash base
was something called a password element.
So a password element went right here.
And the password element was derived from, in part, your WPA3 pre-shared
key, like INE123 or coffee is great or whatever.
So you took that name you typed in for the wireless LAN, that passphrase,
that PSK, and it created a password element using either hunting and pecking
or hash to element.
And that went right here in the generator base.
Now the modulus was a well-known number, depending on what Diffie-Hellman
group was selected.
And then you had a couple of randomly selected exponents.
And there were all sorts of things that took place right here, like the
calculation of a finite field element and the calculation of a scalar
value. But notice right here, first of all, that stuff's not there.
Just a simple Diffie-Hellman exchange.
There's no scalar, there's no finite field element, that doesn't exist.
And instead of having some variable thing, like a pre-shared key or a
password, which goes into the creation of our generator, this generator
here is just a well-known number.
So when you do standard Diffie-Hellman, the generator and the modulus
are well-known as part of the group.
You know, if you choose Diffie-Hellman group 5, there's going to be a
generator and a modulus assigned to that group.
If you do Diffie-Hellman group 19, there will be a different generator
and a different modulus for that.
The only thing that will change will be the randomly selected exponent.
So now they're going to exchange their public keys, we just saw that.
That's in the association request and association response.
Now they have the shared secret that they derive.
And then from the shared secret, they create their pairwise master key.
So here you can see, we just have the two authentication messages, which
are open. So you notice the authentication here just has open system,
just a regular 802.11 open authentication, nothing special about that.
All the special sauce happens here in the association request and the
association response.
And then we go through our four -way EPU overland key message.
Ignore the fact that this one has message number three duplicated.
There was just some weirdness happening there at the time.
But as long as you get through message one through four, you're good.
Now the last thing I want to talk about in here is something called OWE
transition mode.
You might have a situation like, you know, let's say you're the network
administrator at the airport or at the coffee shop.
And once again, you want to offer an open network for people to connect
to. But you say to yourself, you know what, there's going to be thousands
of people going to this airport every single day.
And there's a very good chance that while some of their laptops and tablets
and stuff support OWE, Wi-Fi enhanced open, a lot of them might not.
And, you know, I don't want to have to advertise two wireless LANs because
then how will people know to choose, right?
Grandma waiting for her flight to Denver, Colorado, she's not going to
know which SSID to choose.
So wouldn't it be great if we could just offer one airport network, right?
Put that on signs or whatever, connect to airport dash network or whatever.
And then for those people who do support OWE, they can connect securely
having their traffic encrypted.
But for those people who are running like WPA2 or something, they can
disconnect via a regular open network.
Now they won't have their traffic encrypted, of course.
They're running that risk, but that's because they refused to upgrade
their phone five years ago and they're still walking around with outdated
equipment. So that's shame on them.
So how do we do that?
And that's what OWE transition mode is all about, solving that problem.
So in this particular case, we're actually going to end up creating.
I'm going to walk you through it at a high level first and then we'll
see it in the controller.
We're actually going to create in the controller two wireless LANs.
One that's just a pure open wireless LAN with no encryption authentication,
anything. That's for those older WPA2 devices.
Then we're going to create another wireless LAN that supports our opportunistic
wireless encryption.
But here's where the secret sauce happens.
Number one, we're going to take that opportunistic wireless encryption
wireless LAN and we're going to configure it in such a way that it does
not send out its beacons.
Its beacons are hidden, not broadcasted.
Now you might be thinking, well, if they're not broadcasted, then how
do the OWE clients ever find out about it?
We'll talk about that.
We'll get there.
But here's the beauty of it.
In both of those wireless LANs, we're going to tie them together.
There's a field in both the open one and the OWE one where they point
to each other. And so now when people, people who support OWE will connect
to the right one.
Let's actually walk through this and see how it works.
All right, so let's go back here.
Let's just get out of that.
Okay, so step number one, creating the open wireless LAN that the grandma
and uncle Bob can connect to with her old WPA2 device.
They're not concerned about encryption because honestly, they don't even
know what encryption is.
So we type in airport dash network.
And hopefully they'll be smart enough to recognize when they see that
on their phone that, oh, that's the network I should connect to.
So we want to have that be enabled.
There we go. Remember, we got disable six gigahertz because opportunistic
wireless encryption doesn't work there.
Now this one's not going to have that.
This one, we're just going to go to security.
And we're going to say, none.
Ooh, there's a scary thing.
Okay, but before we leave this, here's the thing.
We're going to have to put that check.
So it's checked by default, which is nice, but we have to put something
here. And what we're going to put here is the wireless LAN ID of the other
wireless LAN we haven't created yet, which is our opportunistic wireless
encryption wireless LAN, our OWE wireless LAN.
Now you say, Hey, I don't know what that is because I haven't created
it yet. That's fine.
So I could do one of two things.
Now, looking at my GUI here, I can see that this is the first wireless
LAN I've ever created, right?
So the wireless LAN IDs are numerical.
First one will be number one, second one will be number two.
So I can pretty much safely predict that by next wireless LAN I create
is going to be wireless LAN ID number two.
So I'm just going to put two right here.
Alternatively, when you create a wireless LAN, like if I go back here,
see, you can change the wireless LAN ID.
You don't have to stick with one, two, three, four.
You could make it whatever you want.
So either way, you have to put some number in here.
But because I know the next one's going to be number two, I'm just going
to keep it as two.
All right. So let's go ahead and apply to device.
And then once again, as you're because it's a 9800, we have to click on
again and we have to make sure that it's assigned to a policy tag and
a policy profile.
Now this one here, because I actually created it before this video started,
it sort of remembered that this was already in there.
And but I previously had to assign this to the default and the default
policy profile. Of course, you could put it on any policy profile in any
policy tag you want just to make things simple, though.
I'm keeping it with the default.
So we'll just select that and then we'll update it.
All righty. So now we have to create the other wireless LAN, which is
going to be for our more tech savvy, OWE folks.
So we're going to call this airport.
OWE. I'll just say airport OWE.
Now, here's first thing.
Obviously, we got turn off six gigahertz.
So the SSID from being broadcast.
There should not be beacons broadcasted with this one.
All right. So now let's go to security.
Now we're going to say WPA three.
We're going to select OWE.
There it is. All right.
And transition mode wireless LAN.
Now we're going to put in here the wireless LAN ID of that first wireless
LAN. And I just created the regular open network wireless LAN, which happened
to be one in this case.
So I'll put that in there.
Apply to device.
All right. Let's just click it again and make sure it's on the correct
policy tags and all that good stuff.
Okay. So it's not showing up there.
So let's go ahead and apply that to the default policy tag and policy
profile. Save that.
Update and apply to device.
And there we go.
Okay. So now step number two, let's go to our dashboard and find out what
channel my particular access point is speaking on because I'm going to
do us a sniffer trace here and I need to know the channel to do that on.
So I'm going to click on the access point.
Click on him again.
And we can see right here in the five giga.
He's doing six channel six in the two point four and he's doing channel
one hundred in the five gigahertz.
So if you're on a Macbook like me, you might not be aware of this, but
you can actually use your Macbook as a wireless sniffer and create and
see your beacons and probes and all that good stuff.
And here's how you do it.
So you go up to your up here in the upper right corner.
Right there. Oops.
Why is it doing that?
Maybe this isn't working here.
Oh, there we go.
Okay. So right there.
We're going to click on the Wi-Fi symbol.
But I'm going to first hold down on my Mac keyboard, the option key.
And then I'm going to click on it left click.
So now by holding down the option key, I get these things here and I want
to click on open wireless diagnostics.
All right. Now, normally when you open wireless diagnostics, you get a
message saying, would you like to start a diagnostic report?
But because I previously did this as sniffer, I'll just say what you would
do here is you would click on window and you would select sniffer and
that will bring up this box right here that you're seeing.
So you're not going to see this immediately.
I saw this because I was previously in sniffer mode, but normally when
you do wireless diagnostics, then you'd have to go window sniffer and
then you'll get this.
And then you select the channel that you want to sniff on.
So I want sniff on channel 100.
And I'm going to go ahead and start.
I'm going to type in my password.
All right. And there it goes.
I'm just going to stop it because, you know, right now I just want to
show you a beacon and there's 10 beacons per second that go out.
So I don't have to sniff for very long.
All right. So let's go over here to wire shark.
File open. So there it is right there.
I'm going to go on Macbook.
So this is my most recent one right there that I just did.
Open that up. And let's scroll down.
And okay, airport network is one of the ones right there.
It's the top one.
So let's go up to here.
And what I want to show you is this.
Let's go ahead and collapse some of these.
What we really want to look at is the robust security network information
element. We don't need all these other ones here.
So this is our open wireless LAN that grandma and uncle Bob.
I don't know why it keeps doing that.
Okay. So airport network.
And notice how because airport network was configured as just a regular
open network with no authentication or anything.
There is no robust security network element in here.
It doesn't exist.
And notice that my other one I create, which was my airport dash OWE for
my opportunistic one.
We don't see any beacons for that.
And that's, that's what we wanted.
Right? The beacons are hidden.
They're not being broadcast.
And yet here's what's kind of interesting.
When we look at the one that is open.
If we go down to the bottom, we see an information element down here.
Wi-Fi Alliance OWE transition mode.
So if Bob's uncle Bob's or grandma's phone was looking at this, it would
not understand this information element.
It would ignore this.
And so their phones would just connect to airport network as an open,
unencrypted connection.
And that's what they would see.
But your modern smartphone will recognize this information element.
And they'll say, Oh, interesting.
There's another hidden SSID called airport one.
There it is right there.
The supports enhanced open.
I should connect to that.
And so let me actually show you verification of that.
So here is my phone.
See if you can see that.
Oh, it is not showing up very well.
There we go. Okay.
So notice you see the airport network on there, but there's no mention
of airport dash OWE.
That's not showing up.
Okay. And those for airport network, it says security week because it's
seeing that as an open network.
But if I click on that.
Okay. Right now it says you're connecting to unsecured Wi-Fi.
Hopefully that will.
Come on. There you go.
Okay. Connecting unsecured Wi-Fi.
But when I click connect.
Now hopefully this will come into focus here.
And just a moment.
It should happen.
There you go. Notice how airport network says security strong connected
security strong.
Now you might be thinking, well, wait a second.
I thought you were connecting to the airport OWE network, but that says
you connected to the airport network, the open one.
Which one is it?
Well, if we go back to our 9800.
Now if we go to our dashboard.
We see a client.
That's my smartphone.
If we click on that.
Notice what SSID he's actually connected to.
Airport dash OWE.
So even though he originally saw the airport dash network as an open network
because my smartphone does support OWE on in the background.
It actually associated securely and did DIFY helmet and everything with
the airport dash OWE network.
Now you might be wondering, well, then why doesn't your smartphone actually
show airport dash OWE?
Well, for two reasons.
Number one, airport dash OWE is not being broadcasted.
Its beacons are not being sent.
And my phone recognizes that.
And number two, my phone is recognizing that the airport network is kind
of like the front door is kind of like the way in to this encrypted network.
So for me, on my phone, it shows because once again, if I was Uncle Bob
or Aunt Sally. And I clicked on airport network and all of a sudden the
name changed to airport dash OWE.
I might be thinking, oh, good golly.
What's going on?
Somebody messing with my phone.
Did I just download a virus?
You don't want people freaking out over that, right?
They think they're connecting the airport network.
Let them stay that way.
So their phone will continue to say airport network, but in the background,
it did what it's supposed to do and actually connected to our opportunistic
wireless encrypted network instead, which is a better thing to do.
So that pretty much covers everything I want to say about Wi-Fi enhanced
open and in the background opportunistic wireless encryption that it uses.
Thank you so much for watching this video and I hope it was helpful for