TKIP Primer (Part I)

WEP (Wired Equivalent Privacy…. and also called as Worst Ever Privacy) was the only security mechanism available in original IEEE 802.11 standard. Within few days of introduction of WEP the implementation related problems in WEP algorithm surfaced and a need for new and strong wireless security standard was felt. The Temporal key Integrity Protocol (TKIP) was an interim solution developed to fix the key reuse problem of WEP. It later became a part of the 802.11i and subsequently a part of WPA standards. TKIP was implemented in such a way that it could be used on old WEP hardware devices with a simple firmware upgrade. The small IV space (Initializing Vector) was the main problem faced by WEP. In TKIP TSC (TKIP Sequence Counter) is used as an IV. TSC is also used for finding message integrity check value which was added in TKIP protocol.

Following are the main parts of TKIP encrypted packet.

1. IEEE 802.11 Header
2. TSC (TKIP Sequence Counter + Key ID)
3. Data
4. MIC (Message Integrity Check – Michael)
5. ICV (Integrity Check Vector – Old WEP)
6. FCS (CRC check sum)

This video talks about the problems with WEP algorithm and the ways in which TKIP tries to solve them. This video along with the TKIP-Introduction Part II video, gives the detailed frame format. For exact encryption technique you are requested to watch more advanced videos on www.securitytube.net The important thing to note here is TKIP is just a temporary solution for WEP hardware devices. The ultimate solution is to migrate to more secure AES algorithms like CCMP.

 

Amit Vartak, 27 is working in wired and wireless security fields since last 3-4 years. His current area of interest includes IEEE 802.11 (Wi-Fi) suite of protocols, vulnerabilities in these protocols and countermeasure for those vulnerabilities. Working on cutting edge tools and technology always keeps him busy. He has contributed from concept level to final prototyping for the presentations in Defcon 2007 (The Emperor Has No Cloak - WEP Cloaking Exposed) and Toorcon 2007 (Caffe latte attack). He holds 2 patents with USPTO (current status: Patent Pending) and a few papers in IEEE journals on wireless protocol vulnerabilities. Prior to this, he was working on MEMS (Micro Electro Mechanical Systems) and has published a few papers in SPIE and ICMAT. (Yeah… kindda orthogonal fields… but technology really doesn’t limit the talent :) He did his masters in Electrical Engineering from one of the premier institutes in India, Indian Institute of Technology, Bombay (IIT-Bombay) and his under graduation, from University of Mumbai in Electronics and Telecommunication Engineering. He is currently working with AirTight Networks Inc. as a team lead in technology group since last 3 years.You can get in touch with him at amitcv[at]gmail[dot]com