802.11 Layer 2 Dynamic Encryption Key Generation

Abstract

This chapter discusses the symbiotic relationship between PSK/802.1X authentication and the generation of dynamic encryption keys. EAP protocols that utilize mutual authentication provide ‘seeding material’ that can be used to generate encryption keys dynamically. Mutual authentication is required to generate unique dynamic encryption keys. EAP?TLS, EAP?TTLS, EAP?FAST, EAP?LEAP, EAP? PEAP, and other versions of EAP utilize mutual authentication and can provide the seeding material needed for dynamic encryption key generation. EAP?MD5 cannot generate dynamic keys because EAP?MD5 uses only one?way authentication. The 802.11i amendment, which was ratified and published as IEEE Std. 802.11i?2004, defined stronger encryption and better authentication methods. The 802.11i security amendment is now part of the 802.11?2012 standard. A robust security network (RSN) is a network that allows for the creation of only robust security network associations (RSNAs). The RSN information element can identify the encryption capabilities of each station. The RSN information element will also indicate whether 802.1X/EAP authentication or preshared key (PSK) authentication is being used. All 802.11 radios will use one cipher suite for unicast encryption and another cipher suite for encrypting multicast and broadcast traffic.