NIS Chapter 07

Question 1

PSK is intended to be used in SOHO environments, why is this?

Answer 1

because PSK does not require the extensive infrastructure and configurations associated with stronger 802.1X

Question 2

What does the 802.11-12 define?

Answer 2

It defines authentication and key management either by PSK or 802.1X/EAP

Question 3

What is the difference and similarity between WPA and WPA2

Answer 3

WPA uses TKIP/RC4 encryption and WPA2-Personal uses CCMP/AES.

Similarity: both use PSK

Question 4

What were the 2 goals of WPA-Personal?

Answer 4

• To stop the use of fixed sized keys
• to stop the need for complicated HEX and ASCII input

Question 5

How does WPA-Personal accomplish its goals?

Answer 5

By allowing a user to enter a passphrase between 8-63 characters that will then be mapped to a PSK

Question 6

What is a PSK?

Answer 6

This is a 256 bit length / 64 character static key that is configured on the client and the AP

Question 7

What is the formula to compute the PSK?

Answer 7

PSK = PBKDF2(PassPhrase, ssid, ssidLength, 4096, 256)

Question 8

What is key stretching?

Answer 8

The added computational work to
make password cracking much more difficult, and is known as key stretching

Question 9

Why is it such a big threat to have a weak SSID and a weak passphrase?

Answer 9

Because the SSID and the passphrase are both used in the computation of the PS which is also used as the PMK as seeding material for the 4way handshake which is used to generate dynamic encryption keys between the clients. And every client station has the same PMK

Question 10

How is the PTK created?

Answer 10

4-Way Handshake uses a pseudo-random function to combine the PMK with the ANonce,
SNonce, AA, and SPA to create a pairwise transient key (PTK).

Question 11

What is the vulnerability found in the 4 way handshake?

Answer 11

ANonce, SNonce, and the MAC addresses of the client station and the access point are
all seen in clear text during the 4-Way Handshake frame exchange.

Question 12

What risk does this impose?

Answer 12

if the hacker derives the PMK from the passphrase all they need to do is to listen in on the 4-way handshake and they have all they need to make a PTK and the decrypt any unicast traffic between the client and AP. In this way both encryption keys and network resources are at risk

Question 13

What is the easier way to obtain the passphrase?

Answer 13

through social engineering

Question 14

What is entropy?

Answer 14

this is the measure pf incertainty associated with a random variable and detemines how diffulcult a password is to crack

Question 15

How many bits of entropy are need to be considered sade?

Answer 15

96

Question 16

How do you increase entrpoy?

Answer 16

mixing lower, upper and numbers and special characters

Question 17

What is a solution to disallow the single passphrase between all clients issue?

Answer 17

• each computing devices had a unique PSK and a DB is kept to manage the pw and the usernames. They can either be generated dynamically or created and can have an expiration date.

Question 18

Explain PSK authentication

Answer 18

PSK authentication is meant to be used in SOHO
environments because the stronger enterprise 802.1X authentication solutions are not
available. PSK authentication is also known by the more common name of WPA - Personal
or WPA2 - Personal.

Question 19

Define entropy and how it relates to PSK authentication

Answer 19

Passwords or passphrases by
themselves have an entropy value of zero. Entropy is a measure of uncertainty associated
with a random variable. The method you use to select a passphrase can be measured in
terms of randomness.

Question 20

Explain the advantages of proprietary PSK solutions

Answer 20

Proprietary PSK solutions prevent
social engineering and employee sharing of a passphrase. Proprietary PSK solutions greatly
limit the ability of malicious users to decrypt user traffi c and simplify administration.