Netgear Router WGR614 V5 User Manual

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
Wireless Networking Basics D-11
June 2004 202-10036-01
The primary information conveyed in the Beacon frames is the authentication method and the 
cipher suite. Possible authentication methods include 802.1X and Pre-shared key. Pre-shared 
key is an authentication method that uses a statically configured pass phrase on both the 
stations and the access point. This obviates the need for an authentication server, which in 
many home and small office environments will not be available nor desirable. Possible cipher 
suites include: WEP, TKIP, and AES (Advanced Encryption Standard). We’ll talk more TKIP 
and AES when addressing data privacy below.
• Authentication. EAP over 802.1X is used for authentication. Mutual authentication is gained 
by choosing an EAP type supporting this feature and is required by WPA. 802.1X port access 
control prevents full access to the network until authentication completes. 802.1X 
EAPOL-Key packets are used by WPA to distribute per-session keys to those stations 
successfully authenticated.
The supplicant in the station uses the authentication and cipher suite information contained in 
the information elements to decide which authentication method and cipher suite to use. For 
example, if the access point is using the Pre-shared key method then the supplicant need not 
authenticate using full-blown 802.1X. Rather, the supplicant must simply prove to the access 
point that it is in possession of the pre-shared key. If the supplicant detects that the service set 
does not contain a WPA information element then it knows it must use pre-WPA 802.1X 
authentication and key management in order to access the network.
• Key management. WPA features a robust key generation/management system that integrates 
the authentication and data privacy functions. Keys are generated after successful 
authentication and through a subsequent 4-way handshake between the station and Access 
Point (AP).
• Data Privacy (Encryption). Temporal Key Integrity Protocol (TKIP) is used to wrap WEP in 
sophisticated cryptographic and security techniques to overcome most of its weaknesses.
• Data integrity. TKIP includes a message integrity code (MIC) at the end of each plaintext 
message to ensure messages are not being spoofed. 
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
D-12 Wireless Networking Basics
June 2004 202-10036-01
WPA Authentication: Enterprise-level User  
Authentication via 802.1x/EAP and RADIUS
Figure D-3:  WPA Overview
IEEE 802.1x offers an effective framework for authenticating and controlling user traffic to a 
protected network, as well as providing a vehicle for dynamically varying data encryption keys via 
EAP from a RADIUS server, for example. This framework enables using a central authentication 
server, which employs mutual authentication so that a rogue wireless user does not join the 
network. 
Its important to note that 802.1x doesnt provide the actual authentication mechanisms. When 
using 802.1x, the EAP type, such as Transport Layer Security (EAP-TLS) or EAP Tunneled 
Transport Layer Security (EAP-TTLS) defines how the authentication takes place. 
Note: For environments with a Remote Authentication Dial-In User Service (RADIUS) 
infrastructure, WPA supports Extensible Authentication Protocol (EAP). For environments 
without a RADIUS infrastructure, WPA supports the use of a preshared key.
Together, these technologies provide a framework for strong user authentication. 
Windows XP implements 802.1x natively, and several Netgear switch and wireless access point 
products support 802.1x. 
WPA 
enabled 
wireless 
client with 
“supplicant”Certificate 
Authority 
(eg Win 
Server, 
Ve r i S i g n ,  
etc)TCP/IP
Ports Closed
Until 
RADIUS Server
Wired Network with Optional 
802.1x Port Based Network 
Access Control
WPA enabled
Access Point 
using
pre-shared key 
or 
802.1x
TCP/IP
Ports Opened
After 
Authenticated
Wireless LAN 
Login
Authentication 
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
Wireless Networking Basics D-13
June 2004 202-10036-01 Figure D-4:  802.1x Authentication Sequence
The AP sends Beacon Frames with WPA information element to the stations in the service set.  
Information elements include the required authentication method (802.1x or Pre-shared key) and 
the preferred cipher suite (WEP, TKIP, or AES). Probe Responses (AP to station) and Association 
Requests (station to AP) also contain WPA information elements.
1.Initial 802.1x communications begin with an unauthenticated supplicant (i.e., client device) 
attempting to connect with an authenticator (i.e., 802.11 access point). The client sends an 
EAP-start message. This begins a series of message exchanges to authenticate the client. 
2.The access point replies with an EAP-request identity message. 
1
2
3
4
5 6
7
Client with a WPA-  
enabled wireless  
adapter and supplicant 
(Win XP, Funk,  
Meetinghouse, etc.) 
 
 
For example, a  
WPA-enabled AP  
 
 
For example, a  
RADIUS server  
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
D-14 Wireless Networking Basics
June 2004 202-10036-01
3.The client sends an EAP-response packet containing the identity to the authentication server. 
The access point responds by enabling a port for passing only EAP packets from the client to 
an authentication server located on the wired side of the access point. The access point blocks 
all other traffic, such as HTTP, DHCP, and POP3 packets, until the access point can verify the 
clients identity using an authentication server (e.g., RADIUS). 
4.The authentication server uses a specific authentication algorithm to verify the clients identity. 
This could be through the use of digital certificates or some other EAP authentication type. 
5.The authentication server will either send an accept or reject message to the access point. 
6.The access point sends an EAP-success packet (or reject packet) to the client. 
7.If the authentication server accepts the client, then the access point will transition the clients 
port to an authorized state and forward additional traffic. 
The important part to know at this point is that the software supporting the specific EAP type 
resides on the authentication server and within the operating system or application “supplicant” 
software on the client devices. The access point acts as a “pass through” for 802.1x messages, 
which means that you can specify any EAP type without needing to upgrade an 802.1x-compliant 
access point. As a result, you can update the EAP authentication type to such devices as token 
cards (Smart Cards), Kerberos, one-time passwords, certificates, and public key authentication or 
as newer types become available and your requirements for security change. 
WPA Data Encryption Key Management
With 802.1x, the rekeying of unicast encryption keys is optional. Additionally, 802.11 and 802.1x 
provide no mechanism to change the global encryption key used for multicast and broadcast 
traffic. With WPA, rekeying of both unicast and global encryption keys is required. 
For the unicast encryption key, the Temporal Key Integrity Protocol (TKIP) changes the key for 
every frame, and the change is synchronized between the wireless client and the wireless access 
point (AP). For the global encryption key, WPA includes a facility (the Information Element) for 
the wireless AP to advertise the changed key to the connected wireless clients.
If configured to implement dynamic key exchange, the 802.1x authentication server can return 
session keys to the access point along with the accept message. The access point uses the session 
keys to build, sign and encrypt an EAP key message that is sent to the client immediately after 
sending the success message. The client can then use contents of the key message to define 
applicable encryption keys. In typical 802.1x implementations, the client can automatically change 
encryption keys as often as necessary to minimize the possibility of eavesdroppers having enough 
time to crack the key in current use.  
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
Wireless Networking Basics D-15
June 2004 202-10036-01
Temporal Key Integrity Protocol (TKIP)
WPA uses TKIP to provide important data encryption enhancements including a per-packet key 
mixing function, a message integrity check (MIC) named Michael, an extended initialization 
vector (IV) with sequencing rules, and a re-keying mechanism. TKIP also provides for the 
following: 
• The verification of the security configuration after the encryption keys are determined. 
• The synchronized changing of the unicast encryption key for each frame. 
• The determination of a unique starting unicast encryption key for each preshared key 
authentication.
Michael
With 802.11 and WEP, data integrity is provided by a 32-bit integrity check value (ICV) that is 
appended to the 802.11 payload and encrypted with WEP. Although the ICV is encrypted, you can 
use cryptanalysis to change bits in the encrypted payload and update the encrypted ICV without 
being detected by the receiver.
With WPA, a method known as Michael specifies a new algorithm that calculates an 8-byte 
message integrity code (MIC) using the calculation facilities available on existing wireless 
devices. The MIC is placed between the data portion of the IEEE 802.11 frame and the 4-byte ICV. 
The MIC field is encrypted together with the frame data and the ICV.
Michael also provides replay protection. A new frame counter in the IEEE 802.11 frame is used to 
prevent replay attacks.
AES Support
One of the encryption methods supported by WPA beside TKIP is the advanced encryption 
standard (AES), although AES support will not be required initially for Wi-Fi certification. This is 
viewed as the optimal choice for security conscience organizations, but the problem with AES is 
that it requires a fundamental redesign of the NIC’s hardware in both the station and the access 
point. TKIP was a pragmatic compromise that allows organizations to deploy better security while 
AES capable equipment is being designed, manufactured, and incrementally deployed. 
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
D-16 Wireless Networking Basics
June 2004 202-10036-01
Is WPA Perfect?
WPA is not without its vulnerabilities. Specifically, it is susceptible to denial of service (DoS) 
attacks. If the access point receives two data packets that fail the Message Integrity Code (MIC) 
check within 60 seconds of each other then the network is under an active attack, and as a result, 
the access point employs counter measures, which includes disassociating each station using the 
access point. This prevents an attacker from gleaning information about the encryption key and 
alerts administrators, but it also causes users to lose network connectivity for 60 seconds. More 
than anything else, this may just prove that no single security tactic is completely invulnerable. 
WPA is a definite step forward in WLAN security over WEP and has to be thought of as a single 
part of an end-to-end network security strategy.
Product Support for WPA
Starting in August, 2003, NETGEAR, Inc. wireless Wi-Fi certified products will support the WPA 
standard. NETGEAR, Inc. wireless products that had their Wi-Fi certification approved before 
August, 2003 will have one year to add WPA so as to maintain their Wi-Fi certification.
WPA requires software changes to the following: 
• Wireless access points 
• Wireless network adapters 
• Wireless client programs
Supporting a Mixture of WPA and WEP Wireless Clients
To support the gradual transition of WEP-based wireless networks to WPA, a wireless AP can 
support both WEP and WPA clients at the same time. During the association, the wireless AP 
determines which clients use WEP and which clients use WPA. The disadvantage to supporting a 
mixture of WEP and WPA clients is that the global encryption key is not dynamic. This is because 
WEP-based clients cannot support it. All other benefits to the WPA clients, such as integrity, are 
maintained.
However, a mixed mode supporting WPA and non-WPA clients would offer network security that 
is no better than that obtained with a non-WPA network, and thus this mode of operation is 
discouraged.
Changes to Wireless Access Points
Wireless access points must have their firmware updated to support the following:  
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
Wireless Networking Basics D-17
June 2004 202-10036-01
•The new WPA information element 
To advertise their support of WPA, wireless APs send the beacon frame with a new 802.11 
WPA information element that contains the wireless APs security configuration (encryption 
algorithms and wireless security configuration information). 
•The WPA two-phase authentication 
Open system, then 802.1x (EAP with RADIUS or preshared key). 
•TKIP 
•Michael 
•AES (optional)
To upgrade your wireless access points to support WPA, obtain a WPA firmware update from your 
wireless AP vendor and upload it to your wireless AP.
Changes to Wireless Network Adapters
Wireless network adapters must have their firmware updated to support the following: 
•The new WPA information element 
Wireless clients must be able to process the WPA information element and respond with a 
specific security configuration. 
•The WPA two-phase authentication  
Open system, then 802.1x (EAP or preshared key). 
•TKIP 
•Michael 
•AES (optional)
To upgrade your wireless network adapters to support WPA, obtain a WPA update from your 
wireless network adapter vendor and update the wireless network adapter driver.
For Windows wireless clients, you must obtain an updated network adapter driver that supports 
WPA. For wireless network adapter drivers that are compatible with Windows XP (Service Pack 1) 
and Windows Server 2003, the updated network adapter driver must be able to pass the adapters 
WPA capabilities and security configuration to the Wireless Zero Configuration service. 
Microsoft has worked with many wireless vendors to embed the WPA firmware update in the 
wireless adapter driver. So, to update you Windows wireless client, all you have to do is obtain the 
new WPA-compatible driver and install the driver. The firmware is automatically updated when 
the wireless network adapter driver is loaded in Windows. 
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
D-18 Wireless Networking Basics
June 2004 202-10036-01
Changes to Wireless Client Programs
Wireless client programs must be updated to permit the configuration of WPA authentication (and 
preshared key) and the new WPA encryption algorithms (TKIP and the optional AES component).
To obtain the Microsoft WPA client program, visit the following Microsoft Web site. 
						

							June 2004 202-10036-01 Glossary
1
Glossary
Use the list below to find definitions for technical terms used in this manual.
List of Glossary Terms
10BASE-T 
IEEE 802.3 specification for 10 Mbps Ethernet over twisted pair wiring.
100BASE-Tx 
IEEE 802.3 specification for 100 Mbps Ethernet over twisted pair wiring.
802.1x
802.1x defines port-based, network access control used to provide authenticated network access and 
automated data encryption key management. 
The IEEE 802.1x draft standard offers an effective framework for authenticating and controlling user traffic 
to a protected network, as well as dynamically varying encryption keys. 802.1x uses a protocol called EAP 
(Extensible Authentication Protocol) and supports multiple authentication methods, such as token cards, 
Kerberos, one-time passwords, certificates, and public key authentication. For details on EAP specifically, 
refer to IETFs RFC 2284.
802.11a
IEEE specification for wireless networking at 54 Mbps operating in unlicensed radio bands over 5GHz.
802.11b
IEEE specification for wireless networking at 11 Mbps using direct-sequence spread-spectrum (DSSS) 
technology and operating in the unlicensed radio spectrum at 2.5GHz.
802.11g
A soon to be ratified IEEE specification for wireless networking at 54 Mbps using direct-sequence 
spread-spectrum (DSSS) technology and operating in the unlicensed radio spectrum at 2.5GHz. 802.11g is 
backwards compatible with 802.11b.
ADSL
Short for asymmetric digital subscriber line, a technology that allows data to be sent over existing copper 
telephone lines at data rates of from 1.5 to 9 Mbps when receiving data (known as the downstream rate) and 
from 16 to 640 Kbps when sending data (known as the upstream rate).  
						

							Reference Manual for the 54 Mbps Wireless Router WGR614 v5
2Glossary
June 2004 202-10036-01
ADSL requires a special ADSL modem. ADSL is growing in popularity as more areas around the world 
gain access. 
AES
Advanced Encryption Standard, a symmetric 128-bit block data encryption technique. 
It is an iterated block cipher with a variable block length and a variable key length. The block length and the 
key length can be independently specified to 128, 192 or 256 bits.The U.S government adopted the 
algorithm as its encryption technique in October 2000, replacing the DES encryption it used. AES works at 
multiple network layers simultaneously.
ARP
Address Resolution Protocol, a TCP/IP protocol used to convert an IP address into a physical address (called 
a DLC address), such as an Ethernet address. 
A host wishing to obtain a physical address broadcasts an ARP request onto the TCP/IP network. The host 
on the network that has the IP address in the request then replies with its physical hardware address. There is 
also Reverse ARP (RARP) which can be used by a host to discover its IP address. In this case, the host 
broadcasts its physical address and a RARP server replies with the hosts IP address.
Auto Uplink
Auto UplinkTM technology (also called MDI/MDIX) eliminates the need to worry about crossover vs. 
straight-through Ethernet cables. Auto UplinkTM will accommodate either type of cable to make the right 
connection.
Cat 5
Category 5 unshielded twisted pair (UTP) cabling. An Ethernet network operating at 10 Mbits/second 
(10BASE-T) will often tolerate low quality cables, but at 100 Mbits/second (10BASE-Tx) the cable must be 
rated as Category 5, or Cat 5 or Cat V, by the Electronic Industry Association (EIA). 
This rating will be printed on the cable jacket. Cat 5 cable contains eight conductors, arranged in four 
twisted pairs, and terminated with an RJ45 type connector. In addition, there are restrictions on maximum 
cable length for both 10 and 100 Mbits/second networks.
Denial of Service attack
DoS. A hacker attack designed to prevent your computer or network from operating or communicating.
DHCP
An Ethernet protocol specifying how a centralized DHCP server can assign network configuration 
information to multiple DHCP clients. The assigned information includes IP addresses, DNS addresses, and 
gateway (router) addresses.
DMZ
A Demilitarized Zone is used by a company that wants to host its own Internet services without sacrificing 
unauthorized access to its private network.