WEBVTT

1
00:00.000 --> 00:05.640
So, how does WPA allow us to form encryption keys?

2
00:05.640 --> 00:09.000
Again, we mentioned that the pre-shared key is not the encryption key, so

3
00:09.000 --> 00:09.520
whether we're

4
00:09.520 --> 00:16.120
doing personal or enterprise, we do need to somehow get to the keys.

5
00:16.120 --> 00:20.320
And we're going to use a process known as the four-way handshake.

6
00:20.320 --> 00:24.990
This is a rather famous or potentially infamous method that could talk about an

7
00:24.990 --> 00:25.600
awful lot

8
00:25.600 --> 00:28.600
when it comes to our wireless security conversations.

9
00:28.600 --> 00:32.680
So the point that this shows up on the blueprint for this exam.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:28.600 --> 00:32.680
So the point that this shows up on the blueprint for this exam.

10
00:32.680 --> 00:37.760
When a wireless station wants to join a wireless network, we're going to go

11
00:37.760 --> 00:38.760
through this four-way

12
00:38.760 --> 00:43.080
handshake process, and it's initiated by the access point.

13
00:43.080 --> 00:48.710
So message number one gets sent down to the station, message two gets sent back

14
00:48.710 --> 00:49.160
to the

15
00:49.160 --> 00:54.000
AP, then we have a third message and a fourth message.

16
00:54.000 --> 00:58.800
Now from a wireless perspective, we have to acknowledge wireless messages.

17
00:58.800 --> 01:04.530
And so each one of these also gets acknowledged, which allows the other side to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:58.800 --> 01:04.530
And so each one of these also gets acknowledged, which allows the other side to

18
01:04.530 --> 01:05.280
know that

19
01:05.280 --> 01:07.200
it was properly received.

20
01:07.200 --> 01:10.660
So we could argue that there's eight messages here, but usually acknowledgments

21
01:10.660 --> 01:11.460
aren't considered

22
01:11.460 --> 01:13.160
part of the wireless communication.

23
01:13.160 --> 01:17.080
I just wanted to point out that there is an acknowledgment with each one.

24
01:17.080 --> 01:20.330
Message two doesn't acknowledge message one, for example, even though we could

25
01:20.330 --> 01:20.800
argue that

26
01:20.800 --> 01:23.360
it kind of does, because we wouldn't be sending it.

27
01:23.360 --> 01:26.640
If we hadn't received the first message.

28
01:26.640 --> 01:30.840
Now when we're talking about WPA personal, this is a fairly straightforward
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:26.640 --> 01:30.840
Now when we're talking about WPA personal, this is a fairly straightforward

29
01:30.840 --> 01:31.600
process,

30
01:31.600 --> 01:37.720
because WPA personal is just going to use the PSK.

31
01:37.720 --> 01:41.920
Now as we mentioned, the pre-shared key is not going to be my encryption key.

32
01:41.920 --> 01:47.020
I am deriving the encryption keys as part of this process, but it's the PSK

33
01:47.020 --> 01:47.840
that's going

34
01:47.840 --> 01:50.960
to allow me to initiate this process.

35
01:50.960 --> 01:58.320
And so I simply follow the four way handshake, and we end up with a key on both

36
01:58.320 --> 01:58.960
sides.

37
01:58.960 --> 02:04.090
So I've got a key over here, and I've got an encryption key over here, and now
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:58.960 --> 02:04.090
So I've got a key over here, and I've got an encryption key over here, and now

38
02:04.090 --> 02:04.480
we can

39
02:04.480 --> 02:06.000
encrypt our traffic.

40
02:06.000 --> 02:08.680
So we go through this process, no problem.

41
02:08.680 --> 02:11.200
Personal addition is pretty straightforward.

42
02:11.200 --> 02:15.210
Things get a little more complicated when we're talking about the enterprise

43
02:15.210 --> 02:16.160
addition, because

44
02:16.160 --> 02:21.490
as we mentioned, the enterprise version of WPA is going to require an

45
02:21.490 --> 02:22.880
authentication

46
02:22.880 --> 02:27.920
server in the 802.1x architecture.

47
02:27.920 --> 02:31.400
So we're typically going to use radius for this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

47
02:27.920 --> 02:31.400
So we're typically going to use radius for this.

48
02:31.400 --> 02:35.740
And the way this works is that when the station wants to authenticate to the

49
02:35.740 --> 02:36.720
access point,

50
02:36.720 --> 02:41.600
we're actually going to start with a bunch of EAP messages.

51
02:41.600 --> 02:44.120
Depending on our EAP type, this might be a few messages.

52
02:44.120 --> 02:49.060
This might be a lot of messages, but we have to perform our authentication

53
02:49.060 --> 02:50.080
first.

54
02:50.080 --> 02:54.200
So this is going to involve communications on the back end again with this

55
02:54.200 --> 02:55.320
radius server.

56
02:55.320 --> 02:59.140
The authenticator or access point in this case, or possibly a wireless LAN

57
02:59.140 --> 02:59.880
controller,

58
02:59.880 --> 03:02.840
is going to have to communicate as part of this process.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:59.880 --> 03:02.840
is going to have to communicate as part of this process.

59
03:02.840 --> 03:07.080
There's a lot of back and forth that happens here before we even get to the WPA

60
03:07.080 --> 03:07.720
four way

61
03:07.720 --> 03:09.040
handshake.

62
03:09.040 --> 03:14.360
But once EAP process is done and we have fully authenticated this device, which

63
03:14.360 --> 03:14.600
remember,

64
03:14.600 --> 03:18.300
we did authenticate the device before, but that included just having the pre

65
03:18.300 --> 03:19.200
shared key

66
03:19.200 --> 03:20.480
on the personal side.

67
03:20.480 --> 03:24.930
It provides both the derivation of our encryption keys and our authentication

68
03:24.930 --> 03:25.800
mechanism.

69
03:25.800 --> 03:28.120
But here we have a different authentication mechanism.

70
03:28.120 --> 03:32.220
So we start there, prove we belong on the network, and now we need to derive
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
03:28.120 --> 03:32.220
So we start there, prove we belong on the network, and now we need to derive

71
03:32.220 --> 03:33.160
the encryption

72
03:33.160 --> 03:34.160
keys.

73
03:34.160 --> 03:39.560
So we're still going to then see that the four way handshake progresses.

74
03:39.560 --> 03:43.760
This is our WPA four way handshake.

75
03:43.760 --> 03:48.410
And then the result of this is our encryption keys, which is one of the

76
03:48.410 --> 03:49.720
ultimate goals is

77
03:49.720 --> 03:53.240
to be able to encrypt our wireless traffic.

78
03:53.240 --> 03:58.300
Now an important part of anything when it comes to security and authentication

79
03:58.300 --> 03:58.520
is to

80
03:58.520 --> 04:02.120
consider the impact of roaming.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
03:58.520 --> 04:02.120
consider the impact of roaming.

81
04:02.120 --> 04:04.760
So we talked a little bit about roaming earlier.

82
04:04.760 --> 04:06.560
Roming can be very disruptive.

83
04:06.560 --> 04:09.840
Roming is when I move from one access point to another because I get out of

84
04:09.840 --> 04:10.520
range of this

85
04:10.520 --> 04:15.760
AP and I'm in range of this new AP, I'm migrating this way.

86
04:15.760 --> 04:20.750
Well, if I'm not using some help using the wireless LAN controllers, I have to

87
04:20.750 --> 04:21.520
go through

88
04:21.520 --> 04:23.240
this whole process again.

89
04:23.240 --> 04:28.680
I have to do the four way handshake here to start with one, two, three, four,

90
04:28.680 --> 04:30.000
and potentially
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

90
04:28.680 --> 04:30.000
and potentially

91
04:30.000 --> 04:32.920
all the EAP communications to start with.

92
04:32.920 --> 04:33.920
Well, guess what?

93
04:33.920 --> 04:36.720
When I want to now associate, I'm over here.

94
04:36.720 --> 04:39.780
I want to associate to this access point, I'm going to have to do the whole

95
04:39.780 --> 04:40.280
thing all

96
04:40.280 --> 04:45.320
over again, including the four way handshake.

97
04:45.320 --> 04:50.480
This is enough to make it so that we might drop phone calls.

98
04:50.480 --> 04:55.170
We might result or this might result in us losing communications on the Wi-Fi

99
04:55.170 --> 04:56.200
long enough

100
04:56.200 --> 05:01.840
to disrupt whatever application we're in the middle of using.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
04:56.200 --> 05:01.840
to disrupt whatever application we're in the middle of using.

101
05:01.840 --> 05:06.070
This is why we want to use wireless LAN controllers to facilitate roaming

102
05:06.070 --> 05:08.400
because now the authentication

103
05:08.400 --> 05:13.020
can be passed from one access point to another and make it so I can skip all of

104
05:13.020 --> 05:13.640
this.

105
05:13.640 --> 05:18.350
So this is mitigated heavily with wireless LAN controllers as well as some form

106
05:18.350 --> 05:18.760
of key

107
05:18.760 --> 05:22.870
management that Cisco allows on the wireless LAN controllers, but do keep in

108
05:22.870 --> 05:23.520
mind if we're

109
05:23.520 --> 05:28.020
not using that, then roaming is made all the more disruptive by the security

110
05:28.020 --> 05:29.520
mechanisms.

111
05:29.520 --> 05:31.880
So it's something that we need to be aware of.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
05:29.520 --> 05:31.880
So it's something that we need to be aware of.

112
05:31.880 --> 05:35.050
Now at the end of all this, before we move on to the next conversation, I do

113
05:35.050 --> 05:35.480
want to

114
05:35.480 --> 05:41.480
point out that WPA falls into the category of layer two security.

115
05:41.480 --> 05:46.390
And we'll see this referenced in the configuration of our wireless LAN

116
05:46.390 --> 05:46.920
controllers.

117
05:46.920 --> 05:54.120
Layer two is where Wi-Fi exists and WPA is the name implies with Wi-Fi right in

118
05:54.120 --> 05:54.840
there,

119
05:54.840 --> 06:00.530
Wi-Fi protected access, WPA exists within the realm of Wi-Fi and therefore it's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
05:54.840 --> 06:00.530
Wi-Fi protected access, WPA exists within the realm of Wi-Fi and therefore it's

120
06:00.530 --> 06:00.840
layer

121
06:00.840 --> 06:02.240
two security.

122
06:02.240 --> 06:06.840
I have to go through this four way handshake one way or the other.

123
06:06.840 --> 06:10.590
Personal or enterprise, I have to go through that process just to get

124
06:10.590 --> 06:11.600
associated to the

125
06:11.600 --> 06:14.600
access point and onboard it onto the network.

126
06:14.600 --> 06:18.290
And what we'll find is that there are layer three security mechanisms as well,

127
06:18.290 --> 06:18.760
which won't

128
06:18.760 --> 06:21.960
leverage native wireless association.

129
06:21.960 --> 06:25.000
But this is how the four way handshake comes together.

130
06:25.000 --> 06:28.390
And this is why it's so important that we understand this process, especially

131
06:28.390 --> 06:28.760
potentially

132
06:28.760 --> 06:33.840
as it relates to roaming and the fact that our enterprise four way handshake
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:28.760 --> 06:33.840
as it relates to roaming and the fact that our enterprise four way handshake

133
06:33.840 --> 06:34.720
has to follow

134
06:34.720 --> 06:35.880
the EAP process.