Hello and welcome this video titled WPA3 Easy Connect.
So before we discuss WPA3 Easy Connect and what problem it solves, let's
go back to the real early days of Wi -Fi back in the early 2000s and talk
about some of the problems that existed back then.
So back in those days, Wi-Fi was pretty early, a lot of people were just
getting introduced to it and a lot of non-technical users were sort of
confused by this idea that they had to enter in a WPA or WPA2 passphrase,
especially if what they were dealing with was something like a camera
or a printer or a TV that had a very tiny screen or limited input controls,
which like it says here made inputting that passphrase tedious or error
prone. For example, here we got a passphrase that's quite good, quite
well constructed, nice and secure, but we got a printer over here and
you got to type that thing into these tiny little things which are about
the size of a pinhead.
Good luck with that.
So Wi-Fi developers look for a way to securely deliver the Wi-Fi credentials
to these types of devices in a simple way.
So a person wouldn't have to type in a big long password.
So back in these days, the early solution was something called Wi-Fi protected
setup or WPS. Now I'm not going to get into the gory details of how WPS
works because it's not really supported, it's actually not a good thing,
it's got a lot of weaknesses to it, but it sort of sets the stage for
Wi-Fi easy connect that we're going to talk about here in just a moment.
Now this is launched way back by the Wi-Fi Alliance in 2007.
And with WOT with WPS, of which there are still devices to this day like
access points and things that support it, you have two different device
roles. You've got the registrar, which is the access point itself, and
you have the enrollee, which is your client.
So the way that WPS worked is that a secure encrypted tunnel was created
between these devices so that the registrar could pass to the enrollee
the Wi-Fi passphrase, the WPA, WPA2 passphrase.
So you wouldn't have to type in that passphrase.
So how was that encrypted tunnel created?
If you're not going to type in a passphrase, how do we have a secret that
somehow creates a tunnel?
Well, with WPS, it came in two different flavors.
And a lot of times, for example, access points might support both of these.
One might be a WPS pin.
Like, for example, you might go into an access points web UI or it's GUI
and it would give you the pin, like you see right here.
The pin was always an eight digit pin.
And so if the WPS enrollee, the client device, had a little screen, it'd
be a lot easier to type in eight digits of the pin like this than a potentially
very long, complex WPA passphrase.
It had a combination of letters and numbers and special characters and
all of that stuff.
Or even more simplistically, a lot of times the device would just have
a WPS button, like on this access point right here.
And you would just simply press the WPS button on both sides, which would
open up WPS for a few seconds.
And that would allow an encrypted tunnel to be formed.
Now, once again, not going to get into mechanics of all this.
But the whole idea was for the access point to use this encrypted tunnel
to transfer the WPA or WPA to passphrase down to that enrollee without
ever typing it in on the enrollee itself.
Now, there were some significant problems with this.
For one thing, WPS is not supported for WPA three wireless LANs.
So if you want WPA three, can't do that.
That functionality is gone.
Also, the WPS pin derived method of typing in that eight digit number
was actually proven crackable.
They proved that within an eight digit number like that, with not too
much effort, people could crack it.
And then they'd be able to access your wireless LAN, even though they're
not supposed to be there.
They're not authorized users of the wireless LAN.
And the problem with the push button method, where you push the button
down, is it made your wireless LAN available within a time window of about
two minutes for any nearby device that had WPS capability to join that
wireless LAN. And once again, we don't want everybody on our wireless
LAN. We only want authorized users.
And here's one of the biggest problems with some devices is what if we
had a device that had a radio in it, but it didn't have a WPS push button
and it had no screen and no way for you to enter the pin?
Well, then how you couldn't use WPS on something like that.
And that sort of brings us to the problems of some of today's devices.
So number one, remember, the goal here is that we only want authorized
users and devices to gain access to the wireless LAN.
I mean, if you weren't concerned about that, you would just have an open
wireless LAN without any authentication or encryption whatsoever.
So the fact that you're using a pre -share key or passphrase means you
only want authorized users on it.
But today, there's a lot of Wi-Fi devices that are what's called headless.
Headless meaning there's no management web UI, there's no command line
available, there's no way you can control anything about the Wi-Fi on
that device. For example, Wi-Fi video cameras and doorbells, smart appliances,
and smart light bulbs.
So how can we securely provide Wi-Fi credentials to these types of devices?
So here, we basically got sort of the same problem as we had that WPS
was designed to solve.
But at least with WPS, those client devices had a button you could press
or some tiny little screen or keyboard where you could type in the numbers.
Now we've got things like Wi-Fi enabled light bulbs that don't even have
that. So how do we get our Wi-Fi credentials?
In this case, our WPA3 credentials, because now we're looking at WPA3
to those devices so that they can do the whole SAE handshake and get that
done. And that's where Wi-Fi easy connect comes into play.
So Wi-Fi easy connect also defines some device roles, the configurator
and the enrollee.
Now one thing is different here, the enrollee, that's still the same thing
as previously, right?
Like your headless device, that Wi-Fi light bulb or that Wi-Fi thermostat
that doesn't have any button or anything you can press on it, but we still
need it to connect via Wi-Fi.
That's the enrollee.
However, with WPS, the registrar was the access point itself.
It participated in the WPS process.
Here in Wi-Fi easy connect, the configurator is going to be an intermediary
device such as your smartphone, such as your tablet that has already connected
to the wireless LAN, already knows what the credentials are because you
typed it into your tablet or your smartphone.
And now that device is going to turn around and send those credentials
to the light bulb or to the thermostat that is using Wi-Fi easy connect.
So what's happening here is between the configurator, which is, for example,
your smartphone, and you're establishing a mutually authenticated encrypted
channel using public key cryptography to deliver the WPA3 credentials.
And then once that light bulb has the credentials, it can disconnect from
you and then connect to the actual WPA3 SAE wireless LAN using those credentials
that it learned from you, the configurator.
All right, so let's talk about how this actually works.
So Wi-Fi easy connect goes in phases.
And there's three phases here.
There's the bootstrap information exchange.
There's the device provisioning protocol.
And then after that, there's the normal 802.11 connection to the BSS,
where that enrollee will just use WPA3 SAE as normal to connect to the
Wi-Fi. So the bootstrap information exchange process, as we can see here,
it takes place before the device provisioning protocol.
And this is where the configurator, your phone, for example, your tablet,
learns of the enrollee's public key.
So this is a critical piece here.
So a device such as a light bulb or a thermostat or a video camera that
supports Wi-Fi easy connect comes pre -packaged right out of the box with
a hard-coded public and private key pair.
And that's going to be used in this step right here.
So the first step is we need to use some out-of-band mechanism, out-of
-band meaning not Wi-Fi, not 802.11 for the smartphone or the tablet, the
configurator, to retrieve that public key from the light bulb from the
thermostat. And that's what the bootstrap information exchange is used
for. Typically, we think of this as being used by QR codes.
A QR code, you know, on the outside of that light bulb, on the outside
of that thermostat, that QR code can actually encode within it the public
key of that device, of that enrollee, as well as its serial number, as
well as a couple other things that we'll look at in just a second.
So once that out-of-band bootstrap information exchange has happened,
where, for example, with your phone, you scan the QR code and you've gotten
that public key, or there's other ways to do here.
For example, with near-field communications, right?
This is like where you have your credit card and you go to the credit
card reader and instead of inserting it, you just sort of bring it close
to the credit card reader and it's able to, you know, using radio frequencies
extract from your credit card the information needs near-field communications.
You could even use Bluetooth low energy, right?
So Easy Connect doesn't really specify and define what protocol should
be used in the bootstrap information exchange.
Most commonly, it's QR codes, but anything outside of 802.11 Wi-Fi can
be used. The main point here is that we want to get that public key from
the enrollee into the configurator.
However you do that, most commonly QR codes, then you've done your bootstrap
information exchange.
Then you'll begin the device provisioning protocol.
So let's go a little bit more into that bootstrap phase.
Okay, so like it says, this allows headless clients, just think of that
light bulb, for example, to be able to offer their public key in an offline
channel to the configurator.
We've already talked about this.
There's nothing really new on here.
So, for example, here's a QR code.
There could be anything in that, but if that QR code was specifically
once the smartphone or the tablet has scanned that, now we move on to
the device provisioning protocol.
And the device provisioning protocol is going to happen in two stages,
two steps. There's going to be the authentication protocol, where we exchange
public keys between the phone, your configurator, and the enrollee, that
light bulb. We're going to create a secure encrypted tunnel.
So that's going to happen in the authentication protocol.
Then once that's done, then we go into the configuration protocol, where
the configurator actually says, okay, here's the SSID of the wireless
LAN you want to join.
Here's the WPA3 passphrase for that particular wireless LAN.
You're going to need that.
All right, so let's go through each stage.
First of all, starting with the device provisioning protocol authentication
stage. So notice a couple things here about the enrollee right off the
bat. Number one, this enrollee, as soon as you give it power, you know,
you screw in the light bulb, or maybe this is a little video camera, whatever
it is, it's automatically listening to some sort of Wi-Fi channel, most
commonly something in the 2.4 gigahertz band like channel one, six, or
11. So it's listening there.
And it's pre-programmed to do that.
So in this QR code, that's one of the other things that's in there, not
just the public key that's hard-coded into this guy, but also the channel
he's listening to.
Okay, so that's already there.
So you plug that guy in, he's ready to go.
Now, you whip out your tablet or your smartphone, and you connect to the
wireless LAN, the WPA3 wireless LAN, you find the SSID, you type in the
passphrase, go through the whole SAE process, and now you're securely
joined to it. So now that the configurator has those credentials, it's
going to be his job to give those credentials to the enrollee.
And here's how it's going to happen.
So step number one is the bootstrap phase.
So he turns his little camera eyeball onto that QR code, scans the QR
code, and retrieves from it those things we've talked about, the public
key, the channel that device is listening to a few other things.
And like we said, this doesn't have to be a QR code scan could do Bluetooth
low energy or other things as well.
So at that point, the bootstrap phase is done.
The configurator has retrieved the information he needs.
Now, at this point, the configurator will create any femoral public and
private key pair.
Okay, so just for this session.
Now this is important because if so once this is all done, this configurator
is going to go back to being connected to this access point.
So if the configurator ever scanned the QR code a second, third, fourth
time of this device, it would create a new public private key pair.
So this is only created so that the device provisioning protocol can do
its thing. And so he can securely transmit the Wi-Fi credentials to this
enrollee. Now the enrollee has a hard coded public private key pair in
there. Okay, so he's got that.
And like I said, the public key was transmitted or encoded, I should say,
in the QR code. All right, so now the configurator is going to set up
a Wi-Fi direct point to point connection with this enrollee.
Now this is not a full fledged 802.11 infrastructure mode Wi-Fi connection.
I don't know if you know anything about Wi-Fi direct is kind of interesting.
You might want after this video is done, you might just want to chat GPT
that and see how it works.
But it's just it's a point to point connection that actually uses special
802.11 action frames called public action frames to do everything it needs
to do. So there's not going to be any 802.11 data frames or beacons or
anything here. It's going to be an exchange of special action frames between
the configurator and the enrollee.
And this is all going to happen across the channel that the enrollee is
already listening to that's his own public key.
In this case, it's little a plus some data he has encrypted with the enrollee's
public key that he got when he scanned that QR code.
So once the enrollee gets that Wi-Fi direct message with that stuff in
it, then he's going to derive his own ephemeral public private key pair.
So notice he's actually got two of them now.
He's got one that's always in there static embedded in the QR code.
But every time everybody tries to reach out to him over Wi-Fi direct,
he's going to derive a unique fresh set of public private keys.
Once he's got that, now he's got everything he needs to derive a shared
session secret key.
He's got the public key of the configurator.
And the configurator has proven himself, he's authenticated himself to
the enrollee. He said, look, I'm authenticated to talk to you because
I know what your public key is.
How do I know it?
Because here's some data I encrypted with your public key.
And the enrollee can decrypt that with his private key.
So he says, okay, this clearly must be somebody who has scanned my QR
code. So I will assume he is a trusted device I can listen to.
So with the configurator's public key with his own public key, he's able
to create a shared session key.
And now he sends an DPP authentication response back to the configurator.
He says, hey, here's my ephemeral public key that I created just right
now, just for you.
And then the configurator says a DPP authentication confirm.
So now everything after this point can go across an encrypted tunnel that
was created as a result of this DFI helman type key exchange with public
and private keys on both sides.
So now we're done with the DPP authentication stage.
Now we can get to the fun part with a configuration where we go into the
DPP configuration stage where simply the enrollee says, Hey, configurator,
who should I be talking to?
What's the SSID?
What's the WPA3 credentials I need to have?
So there it is. He sends a configuration request and the configuration,
the configurator responds back with the information.
Notice what's kind of interesting about this is that Wi-Fi easy connect
technically, the configurator could actually send him 802.1x credentials.
He could say, Hey, here's the, you know, we're doing 802.1x on this YOS
LAN. And you know, it's using a certain username and password.
So here you go, you can use that when you authenticate via 802.1x, or
we're using a digital certificate on the wireless LAN.
Here's one that you can use to connect to this wireless LAN.
So the configurator is going to give everything the enrollee needs to
connect. At that point, we're done with the device provisioning protocol.
So that Wi-Fi direct connection can terminate.
There it goes. And now the enrollee can securely join via WPA3 SAE, the
wireless LAN that it wants to.
So some final thoughts about this protocol.
So once the provisioning completes, the enrollee just uses those delivered
credentials to join the wireless LAN, like anybody else would using the
SAE handshake. Like I said, this could also be used to deliver WPA3 enterprise
connections to that enrollee.
That's not widely implemented yet.
You'll probably be hard pressed to find enrollee devices that support
that. And this is a somewhat new technology.
So a lot of devices out there don't support Wi-Fi easy connect yet.
Now you might say, well, wait a second, I've got this Wi-Fi camera here
that I bought like eight years ago that's got a QR code on it.
And I can use that to connect to the Wi-Fi.
I just open up my video camera's special app on my phone.
I download this special app.
I scan the QR code.
Well, hold on a second.
If you're using a special app on your smartphone, that you have to open
up from the manufacturer of that camera so that you can scan that QR code,
that is not this.
That is not Wi-Fi easy connect.
That's some special proprietary mechanism that that manufacturer is using
to talk to their devices.
That however they're doing it, that's not going to work with your thermostat
or your light bulb.
So this was developed by the Wi-Fi alliance to take away all those proprietary
mechanisms and make it much more streamlined.