Perfect Forward Secrecy of Authentication and Key Exchange Protocols in Three Versions of WAPI

INTRODUCTION

Wireless Local Area Networks (WLAN) are now being widely deployed for many applications, but security remains one of the most critical challenges yet to be fully addressed. Chinese WLAN standard GB 15629.11-2003 (Anonymous, 2003), the first issued Chinese standard in the field of WLAN, has been formally implemented since November 1, 2003. The security solution of it is known as WLAN Authentication and Privacy Infrastructure (WAPI). And in March 2004, China Broadband Wireless IP Standard (BWIPS) Group of National IT Standardization Technical Committee drafted out WAPI Implementation Plan (Anonymous, 2004b), which fixes some drawbacks (Zhang and Ma, 2005a) in the original standard WAPI and is more robust (Zhang and Ma, 2005b; Li and Ma, 2005). However, considering the compatibility with different WLAN security solutions, for example, IEEE 802.11i (Anonymous, 2004a), a new national standard WAPI-XG1 (Anonymous, 2006) is standardized and published by China BWIPS group in July 2006. Then, the context of GB 15629.11-2003 relating to WAPI is adaptively modified. And the Pre-Shared Key (PSK) is adopted in WAPI-XG1 as an alternative to certificate based Authentication and Key Exchange (AKE) which had been proven to be secure by Tang. (Http://eprint.iacr.org/2007/122.pjf) If a PSK is used, the PSK is the Base Key (BK) used to drive the unicast Key exchange protocol. The related national departments had also stated that the new national standard would be used at 2008 Olympic Games.

We will analyze the Perfect Forward Secrecy (PFS) of AKE protocols used in three versions of WAPI. A protocol is said to have PFS if compromise of long-term keys does not compromise past session keys. For an AKE protocol, PFS is a very important security property (Günther, 1990; Menezes, et al., 1996). PFS provides that the compromise of long-term keys does not affect the security of past session keys, which guarantees that previous traffic is locked securely in the past. The results show that all the AKE protocols in three versions of WAPI cannot provide PFS and the PSK-based AKE protocol of WAPI-XG1 is also very weak under an offline dictionary attack. Furthermore, some improvements are presented to overcome these security flaws.

AKE PROTOCOLS IN THREE VERSIONS OF WAPI AND THEIR SECURITY ANALYSIS

The AKE protocol in the original standard WAPI and its security analysis: The key exchange process of WAPI is shown in Fig. 1, where ENC(*) is the encryption function, PK_AP and PK_STA are the public keys of AP and STA, respectively.

Fig. 1:	The AKE protocol in the original standard WAPI

Fig. 2:	The PFS property of the AKE protocol in the original standard WAPI

STA and AP first negotiate a cryptography algorithm, i.e., ENC(*). Then, they respectively generate random value r₁ and r₂. These random values are encrypted with the peer’s public key and sent to each other. Both parties decrypt the encrypted random value and derive the session key K = r₁⊕r₂.

Security analysis the AKE protocol in the original standard WAPI: The protocol does have a weakness: An adversary can easily computes the session key if he has already obtained the long-term keys of STA and AP. Fig. 2 shows the situation.

The AKE protocol in the WAPI implementation plan and its security analysis: The framework in the implementation plan of WAPI is the same as that of the original standard WAPI, which is composed of certificate authentication and key exchange. Compared with the original standard WAPI, the implementation plan remains unchanged in the certificate authentication, but makes a significant improvement in the key exchange. The new key exchange protocol is shown in Fig. 3.

Fig. 3:	The AKE protocol in the WAPI implementation plan

It is different from the original one in the following aspects:

Because the key exchange method used in the implementation plan is the same as in WAPI, an adversary can mount the same attack and then compute the session key as Fig. 2 illustrated.

The PAKE protocol in WAPI-XG1 and its security analysis: Compared with the original standard and the implementation plan, WAPI-XG1 made a rather big improvement in authentication and key exchange. Especially, a Pre-shared Key Authentication and Key Exchange (PAKE) mode is introduced, which provides an easily implemented alternative for the generation of the BK. The PAKE protocol in WAPI-XG1 is shown in Fig. 4.

Fig. 4:	The PAKE protocol in WAPI-XG1

Besides, Param₂ and Param₃ are parameters as Param₁. Then STA computes MIC₁ as Eq. 2:

Finally, STA sends message (BKID, ADDID, N₁, N₂, Param₂, MIC₁) to AP as the unicast key exchange response.

And then AP sends (BKID, ADDID, N₂, Param₃, MIC₁) to STA as the unicast key exchange acknowledgment; Otherwise, AP discards this response message.

Fig. 5:	The PFS property of the AKE protocol in WAPI-XG1

Security analysis the PAKE protocol in WAPI-XG1: The PAKE protocol also cannot provide PFS: It is subject to a passive attack described in Fig. 5.

As shown earlier, the main drawback of WAPI-XG1’s PAKE protocol lies in the lack of PFS property. If PSK is compromised, either all messages previously sent or will be sent can be decrypted and bogus frames may be injected into current traffic.

However, if a passphrase is used as PSK, it is possible for an adversary to perform a dictionary attack using the above-eavesdropped information. This is a big problem because phrases over 20 characters are not really possible when humans are involved. In addition, random strings are difficult to remember and prone to misconfiguration. Therefore phrases are typically found in a dictionary. In current network deployment, a normal practice is to have a single PSK within an Extended Service Set (ESS). To generate any PTK, a device only needs to learn the two MAC addresses (ADDID) and nonces (N₁, N₂). All of this is available by a passive adversary from the message exchange. Any device can passively listen for these frames and then generate PTKs. Thus even though each unicast pairing in the ESS has unique keys there is nothing private about these keys to any other device in the ESS. Once the adversary learns the PSK, the whole ESS is compromised and then the adversary can read and forge any traffic in the ESS.

IMPROVEMENTS TO AKE PROTOCOLS IN THREE VERSIONS OF WAPI

PFS can be provided by generating session keys through Diffie-Hellman (DH) key exchange, wherein the DH exponentials are based on short-term keys. If long-term private keys are compromised, past sessions are also secure. For the implementation plan is the enhanced version of WAPI on security, we do not give the improvement to WAPI. Before the description of new protocols we first review the elliptical-curve computational Diffie-Hellman (ECCDH) assumption which is the security foundation of our protocols.

ECCDH Assumption: Let G₁ is an additive cyclic group of prime order q and P is an arbitrary generator of G₁. given {X = xP, Y = yP: x, yεZ_q}, it is infeasible for any Probabilistic Polynomial-Time (PPT) adversary to compute Z = xyP.

Improvement to the AKE protocol of the implementation plan: We give two improvements to the AKE Protocol of the implementation plan: One is timestamp-based and the other is nonce-based. Both adopt the DH key exchange based on elliptical-curve.

Fig. 6:	The AKE protocol based on timestamp

Then STA sends the key exchange response message (SPI, yP, xP, Sig (SK_STA, xP| yP), HMAC-SHA256 (MAK, SPI)) to AP, where SK_STA is STA’s long-term private key, Sig (SK_STA, xP|yP) is STA’s signature with SK_STA and HMAC-SHA256 (MAK, SPI) is the message authentication code under MAK.

And then sends the key exchange response message (SPI, r₁, r₂, xP, Sig (SK_STA, r₁| r₂| xP| yP), HMAC-SHA256 (MAK, SPI)) to AP.

Fig. 7:	The AKE protocol based on nonce

Fig. 8:	The DH-based PAKE protocol

Improvement to the PAKE Protocol of WAPI-XG1: In the improvement protocol described in Fig. 8, STA and AP execute the same operations as the PAKE protocol except that:

The message authentication code is computed as Eq. 9:

Finally, STA sends (BKID, ADDID, N₁, N₂, Param₂, MIC₁) to AP as the key exchange response message.

Security Analysis of The Improvements: In the improvement protocols, the session keys are computed as follows, respectively.

From the equations above, we know that the long-term keys of STA and AP are not involved in the computation of different session keys, so the losses of long-term keys do not affect the security of past session keys. Furthermore, according to the definition of ECCDH assumption, the adversary can not compute xyP even through he has obtained long-term keys, SPI, N₁, N₂, r₁, r₂, xP, yP. Namely, the adversary can not compute the session keys. Hence, all the improvement protocols can provide PFS.