10 ms·

Wi-Fi Alliance Introduces Wi-Fi Certified WPA3 Security

276 points by nikolay 8y ago

yuhong 8y ago
WPA3 Personal seems to be another name for SAE that was defined in 802.11s
excalibur 8y ago
> Wi-Fi Alliance is also introducing Wi-Fi CERTIFIED Easy Connect™, a new program that reduces the complexity of onboarding Wi-Fi devices with limited or no display interface – such as devices coming to market for Internet of Things (IoT) – while still maintaining high security standards. Wi-Fi Easy Connect™ enables users to securely add any device to a Wi-Fi network using another device with a more robust interface, such as a smartphone, by simply scanning a product quick response (QR) code. Wi-Fi Easy Connect and WPA3 represent the latest evolution in Wi-Fi Alliance programs to ensure users receive a positive experience while remaining securely connected as the security landscape evolves. This is highly reminiscent of WPS. The language indicates that they've learned their lesson and focused on making the standard secure, at least in theory. Time will tell how well it's implemented, but history says to be skeptical and disable it for the time being.
- sandworm101 8y ago
  It is allowing any device already on the network to vouch for new devices. What could possibly go wrong? WPS had flaws in its implementation, but was reasonable on a theoretical level. This seems foolhardy at best. WPA2, when properly implemented, is very secure. I'm not sure of WPA3's real purpose. Is strong encryption of wifi signals of any benefit? The days of banking passwords being send in html gets should be behind us. Anything important will be protected by other encryption layers than wifi. Is WPA3 meant to protect unauthorized network access? WPA2 isn't exactly easy to crack. Do we really need a new scheme, and the inevitable new flaws that come with it? Or is this really about streamlining the user experience, about making wifi that little bit less complicated, so that people can attached their smart toasters to the home network without having to actually remember the password. To clarify for those who obviously do not understand the difference between protocol and concept implementation: Errors in the protocol would have been inconsequential if WPS was implemented properly. Had it not been left on 24/7, the temporary use of shorter keys would have been a good thing. It would have allowed home networks to adopt much more complex keys without having to type them into every new device (a big deal on things like printers which didn't have keyboards). WPS could have contributed to greater WPA2 security. But instead the concept was improperly implemented, allowing the inevitable errors discovered in the adopted protocol to be leveraged.
  - Ajedi32 8y ago
    It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device: > With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?
    - thisacctforreal 8y ago
      Yes, Apple devices offer to do this for eachother if you are in the person's contacts. Works between your own devices too, requires bluetooth but no pairing.
      - X-Istence 8y ago
        Best thing ever when traveling and your colleague just got the wifi password for the coffee shop you are in and you don't feel like typing it out.
  - d33 8y ago
    > WPA2, when properly implemented, is very secure Not really: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/
    - zokier 8y ago
      If I'm not completely mistaken, only the DoS ("Anyone can disconnect you") is valid for true scotsman WPA2 (aka WPA2-EAP aka WPA2-Enterprise). "Silly "terms of service" in your cafe can break your applications and expose you to risk" is hardly fault of WPA2; while some sort of side-channel for provider-provided messages would be nice, I think at least the ToS case could be handled by e.g. DHCP option.
      - 8y ago
- IshKebab 8y ago
  This isn't really like WPS. It's more like... what a lot of IoT devices already do. I'm not sure any IoT devices ever used WPS.
  - comboy 8y ago
    Currently you need bluetooth between your smartphone and the IoT device just to set it up. Maybe with the help of this, bluetooth could be removed.
    - xori 8y ago
      most wifi SoC support peer-to-peer over wifi, now-a-days you don't really need bluetooth.
      - digi_owl 8y ago
        From a user standpoint they lack the profiles that bluetooth has baked in, that ensures that devices can talk to each other with little to no extra software.
      - amckinlay 8y ago
        And if the IoT device is using Wi-Fi anyway there is no need for low power demand of Bluetooth.
    - IshKebab 8y ago
      No, a lot of WiFi IoT devices create a hotspot that your phone connects to. It's hacky as hell - you have to do the connection manually on iOS (unless it uses Homekit), and some devices only support one WiFi connection so they have to disconnect from your phone before attempting to connect to your network so you get zero feedback. But it saves $2 on the BOM.
Ajedi32 8y ago
Wi-Fi enhanced open looks like a nice security enhancement for open networks, but unfortunately (correct me if I'm wrong) it still doesn't look like it protects users from rogue access points; it only stops eavesdropping if users have already connected to the correct network. I'd love to see a system similar to what Wi-Fi is already doing with Easy Connect, where users can scan a public key embedded in a QR Code or NFC tag to securely connect to a Wi-Fi network. (Or does Easy Connect already allow that? It'd be great if it does.)
d33 8y ago
Pardon my negative comment, but given their history of absolutely terrible crypto, I can't wait to see how they mess it up this time. Some thoughts on WPA2: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/
- keeperofdakeys 8y ago
  WPA3 appears to solve these issues. https://www.mathyvanhoef.com/2018/03/wpa3-technical-details.html https://www.mathyvanhoef.com/2018/03/wpa3-technical-details....
bjoli 8y ago
Why wasn't this designed in the open like TLS 1.3? The process behind isn't very confidence inspiring...
- bcaa7f3a8bbc 8y ago
  Because IETF is NOT an industrial alliance, but Wi-Fi Alliance is. See the differences? see also: 3GPP.
  - bjoli 8y ago
    That is the obvious difference, but why don't they develop crypto protocol with a more open model? They have had too many fiascos for me to trust their current model.
- ReverseCold 8y ago
  If a large company wanted to push for a wifi alternative it could probably happen.
amluto 8y ago
I'm not optimistic. I believe that the underlying crypto protocol is this: https://ieeexplore.ieee.org/document/4622764/ https://ieeexplore.ieee.org/document/4622764/ It's "secure authentication of equals", which is a protocol that kind of looks like it's trying to be a PAKE (Password Authenticated Key Exchange), but the paper does not mention PAKE anywhere in its abstract, and I'm not at all confident that SAE's design or analysis takes into account the properties that PAKE protocols should have. I think that the original WPA key exchange was supposed to use the SRP protocol, which is a PAKE, but that was dropped due to patent issues. Since then, as I understand it, quite a few very nice PAKE protocols have had their patents expire, so I don't see what the problem is now. So color me extremely skeptical.
- mrb 8y ago
  Agreed. I'm worried SAE hasn't received as much peer review as other PAKE protocols. IMHO they should have gone with J-PAKE (https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exc...) which is one of the few PAKE protocols that is not patent encumbered and decently peer-reviewed. In fact, that's why Thread (https://www.threadgroup.org/ https://www.threadgroup.org/) selected J-PAKE as their authentication protocol.
- bcaa7f3a8bbc 8y ago
  > the SRP protocol, which is a PAKE, but that was dropped due to patent issues. What about (EC)DHE_PSK, is it also patented? If so, the software patent is fricking insane...
- tptacek 8y ago
  That's a Dan Harkins protocol; Harkins is a little notorious for Dragonfly, a PAKE he tried to get "approved" by IETF CFRG before being slagged by Trevor Perrin†, who wrote up a particularly simple and nasty side channel attack on the elliptic curve point generation technique Dragonfly used. SAE includes what looks like the same "hunt-and-peck" point generator. † https://www.ietf.org/mail-archive/web/tls/current/msg10922.html https://www.ietf.org/mail-archive/web/tls/current/msg10922.h... Later: All I ever read about the Dragonfly PAKE was trevp taking it apart on CFRG, but from a quick skim of this paper and the IETF draft Harkins wrote for Dragonfly, this looks like it's just an instantiation of Dragonfly. That would be pretty funny. What is it about WiFi security that makes it such a backwater?
IshKebab 8y ago
> WPA3 leverages Simultaneous Authentication of Equals (SAE), a secure key establishment protocol between devices, to provide stronger protections for users against password guessing attempts by third parties. Is that their term for PAKE? Also I hope they have finally included an actual error message for incorrect passwords, rather than just "connection failed" which is the best that seems to be possible at the moment.
- bwat49 8y ago
  I've seen some cases where I actually do get an authentication failed error connecting to wifi, but other cases where it just gives me some generic connection failed (even when the issue turns out to be authentication). It seems quite random.
sneak 8y ago
Does this fix the primary problem with WPA presently: the lack of forward secrecy?
- supertrope 8y ago
  If you had followed the link in the PR release labeled "For further information, please visit: https://www.wi-fi.org/discover-wi-fi/security" https://www.wi-fi.org/discover-wi-fi/security" you would have found the following statement: "Forward secrecy: Protects data traffic even if a password is compromised after the data was transmitted" under "WPA3-Personal"
kevingrahl 8y ago
If I understood everything, you have to be a Wi-Fi Alliance member in order to develop/contribute/vote on all things WiFi. The smallest membership that allows you to participate is US$7,500/year for 2018 (next year it’ll be $7,725/year). And that’s only for small businesses and they won’t have all voting rights. The actual membership is a whopping US$15,000/year ($450 more next year). It disgusts me to see that in order to improve something that a crapton of people use daily to protect them self, that’s currently broken, you’d have to pay. I didn’t see any mention that individuals can become members on the website of the Wi-Fi Alliance seems to be only businesses can participate. I’d be alright with some open-source implementation instead. /rant
- datamingle 8y ago
  Seems like it would encounter same problem earlier in Wifi history "Early 802.11 products suffered from interoperability problems because the Institute of Electrical and Electronics Engineers (IEEE) had no provision for testing equipment for compliance with its standards." https://en.wikipedia.org/wiki/Wi-Fi_Alliance#History https://en.wikipedia.org/wiki/Wi-Fi_Alliance#History
westmeal 8y ago
WPA2 isn't that bad as long as you use a password that isn't going to be pwned by a dictionary attack in 2 seconds so does this prevent against that if frames are captured? IDK.
- amluto 8y ago
  It attempts to. Whether or not it succeeds depends on whether the highly questionable SAE protocol actually works — see the other comments here.
sgc 8y ago
Given the apparent state of affairs, it seems like the vendor or vendors who care should bake a vpn into their firmware to provide better protection. Of course it is possible to use a pi or perhaps integrate into an open source firmware, but having a simple vendor provided config would be much better for adoption rates.
bo1024 8y ago
Wow, I hadn't realized that WiFi standards were developed like this. Looking down the page, I see a bunch of TM symbols, endorsements from massive companies, and no technical details or even attempt to describe anything related to security. Not very confidence-inspiring to an outsider.
auslander 8y ago
Security of Wi-Fi will always be a shit show, because standards are not public. Want to dig into TLS? RFCs are on internet, ietf.org, in nice courier fonts. Want to dig into WPA2? IEEE wireless security standards carry a retail cost of hundreds of dollars to access, and costs to review multiple interoperable standards can quickly add up to thousands of dollars [0] "IEEE working groups are a closed industry process." [0] www.wired.com/story/krack-wi-fi-meltdown-open-standards/
auslander 8y ago
Revolution is needed. Let IETF take over development of Wi-Fi standards. If it's patents rigged, start from scratch.

276 points by nikolay 8y ago

WPA3 Personal seems to be another name for SAE that was defined in 802.11s

> Wi-Fi Alliance is also introducing Wi-Fi CERTIFIED Easy Connect™, a new program that reduces the complexity of onboarding Wi-Fi devices with limited or no display interface – such as devices coming to market for Internet of Things (IoT) – while still maintaining high security standards. Wi-Fi Easy Connect™ enables users to securely add any device to a Wi-Fi network using another device with a more robust interface, such as a smartphone, by simply scanning a product quick response (QR) code. Wi-Fi Easy Connect and WPA3 represent the latest evolution in Wi-Fi Alliance programs to ensure users receive a positive experience while remaining securely connected as the security landscape evolves. This is highly reminiscent of WPS. The language indicates that they've learned their lesson and focused on making the standard secure, at least in theory. Time will tell how well it's implemented, but history says to be skeptical and disable it for the time being.

sandworm101 8y ago
It is allowing any device already on the network to vouch for new devices. What could possibly go wrong? WPS had flaws in its implementation, but was reasonable on a theoretical level. This seems foolhardy at best. WPA2, when properly implemented, is very secure. I'm not sure of WPA3's real purpose. Is strong encryption of wifi signals of any benefit? The days of banking passwords being send in html gets should be behind us. Anything important will be protected by other encryption layers than wifi. Is WPA3 meant to protect unauthorized network access? WPA2 isn't exactly easy to crack. Do we really need a new scheme, and the inevitable new flaws that come with it? Or is this really about streamlining the user experience, about making wifi that little bit less complicated, so that people can attached their smart toasters to the home network without having to actually remember the password. To clarify for those who obviously do not understand the difference between protocol and concept implementation: Errors in the protocol would have been inconsequential if WPS was implemented properly. Had it not been left on 24/7, the temporary use of shorter keys would have been a good thing. It would have allowed home networks to adopt much more complex keys without having to type them into every new device (a big deal on things like printers which didn't have keyboards). WPS could have contributed to greater WPA2 security. But instead the concept was improperly implemented, allowing the inevitable errors discovered in the adopted protocol to be leveraged.
- Ajedi32 8y ago
  It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device: > With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration. https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?
  - thisacctforreal 8y ago
    Yes, Apple devices offer to do this for eachother if you are in the person's contacts. Works between your own devices too, requires bluetooth but no pairing.
    - X-Istence 8y ago
      Best thing ever when traveling and your colleague just got the wifi password for the coffee shop you are in and you don't feel like typing it out.
- d33 8y ago
  > WPA2, when properly implemented, is very secure Not really: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/
  - zokier 8y ago
    If I'm not completely mistaken, only the DoS ("Anyone can disconnect you") is valid for true scotsman WPA2 (aka WPA2-EAP aka WPA2-Enterprise). "Silly "terms of service" in your cafe can break your applications and expose you to risk" is hardly fault of WPA2; while some sort of side-channel for provider-provided messages would be nice, I think at least the ToS case could be handled by e.g. DHCP option.
    - 8y ago
IshKebab 8y ago
This isn't really like WPS. It's more like... what a lot of IoT devices already do. I'm not sure any IoT devices ever used WPS.
- comboy 8y ago
  Currently you need bluetooth between your smartphone and the IoT device just to set it up. Maybe with the help of this, bluetooth could be removed.
  - xori 8y ago
    most wifi SoC support peer-to-peer over wifi, now-a-days you don't really need bluetooth.
    - digi_owl 8y ago
      From a user standpoint they lack the profiles that bluetooth has baked in, that ensures that devices can talk to each other with little to no extra software.
    - amckinlay 8y ago
      And if the IoT device is using Wi-Fi anyway there is no need for low power demand of Bluetooth.
  - IshKebab 8y ago
    No, a lot of WiFi IoT devices create a hotspot that your phone connects to. It's hacky as hell - you have to do the connection manually on iOS (unless it uses Homekit), and some devices only support one WiFi connection so they have to disconnect from your phone before attempting to connect to your network so you get zero feedback. But it saves $2 on the BOM.

Ajedi32 8y ago

Wi-Fi enhanced open looks like a nice security enhancement for open networks, but unfortunately (correct me if I'm wrong) it still doesn't look like it protects users from rogue access points; it only stops eavesdropping if users have already connected to the correct network. I'd love to see a system similar to what Wi-Fi is already doing with Easy Connect, where users can scan a public key embedded in a QR Code or NFC tag to securely connect to a Wi-Fi network. (Or does Easy Connect already allow that? It'd be great if it does.)

d33 8y ago

Pardon my negative comment, but given their history of absolutely terrible crypto, I can't wait to see how they mess it up this time. Some thoughts on WPA2: https://github.com/d33tah/call-for-wpa3/ https://github.com/d33tah/call-for-wpa3/

keeperofdakeys 8y ago
WPA3 appears to solve these issues. https://www.mathyvanhoef.com/2018/03/wpa3-technical-details.html https://www.mathyvanhoef.com/2018/03/wpa3-technical-details....

bjoli 8y ago

Why wasn't this designed in the open like TLS 1.3? The process behind isn't very confidence inspiring...

bcaa7f3a8bbc 8y ago
Because IETF is NOT an industrial alliance, but Wi-Fi Alliance is. See the differences? see also: 3GPP.
- bjoli 8y ago
  That is the obvious difference, but why don't they develop crypto protocol with a more open model? They have had too many fiascos for me to trust their current model.
ReverseCold 8y ago
If a large company wanted to push for a wifi alternative it could probably happen.

amluto 8y ago

I'm not optimistic. I believe that the underlying crypto protocol is this: https://ieeexplore.ieee.org/document/4622764/ https://ieeexplore.ieee.org/document/4622764/ It's "secure authentication of equals", which is a protocol that kind of looks like it's trying to be a PAKE (Password Authenticated Key Exchange), but the paper does not mention PAKE anywhere in its abstract, and I'm not at all confident that SAE's design or analysis takes into account the properties that PAKE protocols should have. I think that the original WPA key exchange was supposed to use the SRP protocol, which is a PAKE, but that was dropped due to patent issues. Since then, as I understand it, quite a few very nice PAKE protocols have had their patents expire, so I don't see what the problem is now. So color me extremely skeptical.

mrb 8y ago
Agreed. I'm worried SAE hasn't received as much peer review as other PAKE protocols. IMHO they should have gone with J-PAKE (https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exchange_by_Juggling https://en.wikipedia.org/wiki/Password_Authenticated_Key_Exc...) which is one of the few PAKE protocols that is not patent encumbered and decently peer-reviewed. In fact, that's why Thread (https://www.threadgroup.org/ https://www.threadgroup.org/) selected J-PAKE as their authentication protocol.
bcaa7f3a8bbc 8y ago
> the SRP protocol, which is a PAKE, but that was dropped due to patent issues. What about (EC)DHE_PSK, is it also patented? If so, the software patent is fricking insane...
tptacek 8y ago
That's a Dan Harkins protocol; Harkins is a little notorious for Dragonfly, a PAKE he tried to get "approved" by IETF CFRG before being slagged by Trevor Perrin†, who wrote up a particularly simple and nasty side channel attack on the elliptic curve point generation technique Dragonfly used. SAE includes what looks like the same "hunt-and-peck" point generator. † https://www.ietf.org/mail-archive/web/tls/current/msg10922.html https://www.ietf.org/mail-archive/web/tls/current/msg10922.h... Later: All I ever read about the Dragonfly PAKE was trevp taking it apart on CFRG, but from a quick skim of this paper and the IETF draft Harkins wrote for Dragonfly, this looks like it's just an instantiation of Dragonfly. That would be pretty funny. What is it about WiFi security that makes it such a backwater?

IshKebab 8y ago

> WPA3 leverages Simultaneous Authentication of Equals (SAE), a secure key establishment protocol between devices, to provide stronger protections for users against password guessing attempts by third parties. Is that their term for PAKE? Also I hope they have finally included an actual error message for incorrect passwords, rather than just "connection failed" which is the best that seems to be possible at the moment.

bwat49 8y ago
I've seen some cases where I actually do get an authentication failed error connecting to wifi, but other cases where it just gives me some generic connection failed (even when the issue turns out to be authentication). It seems quite random.

sneak 8y ago

Does this fix the primary problem with WPA presently: the lack of forward secrecy?

supertrope 8y ago
If you had followed the link in the PR release labeled "For further information, please visit: https://www.wi-fi.org/discover-wi-fi/security" https://www.wi-fi.org/discover-wi-fi/security" you would have found the following statement: "Forward secrecy: Protects data traffic even if a password is compromised after the data was transmitted" under "WPA3-Personal"

kevingrahl 8y ago

If I understood everything, you have to be a Wi-Fi Alliance member in order to develop/contribute/vote on all things WiFi. The smallest membership that allows you to participate is US$7,500/year for 2018 (next year it’ll be $7,725/year). And that’s only for small businesses and they won’t have all voting rights. The actual membership is a whopping US$15,000/year ($450 more next year). It disgusts me to see that in order to improve something that a crapton of people use daily to protect them self, that’s currently broken, you’d have to pay. I didn’t see any mention that individuals can become members on the website of the Wi-Fi Alliance seems to be only businesses can participate. I’d be alright with some open-source implementation instead. /rant

datamingle 8y ago
Seems like it would encounter same problem earlier in Wifi history "Early 802.11 products suffered from interoperability problems because the Institute of Electrical and Electronics Engineers (IEEE) had no provision for testing equipment for compliance with its standards." https://en.wikipedia.org/wiki/Wi-Fi_Alliance#History https://en.wikipedia.org/wiki/Wi-Fi_Alliance#History

westmeal 8y ago

WPA2 isn't that bad as long as you use a password that isn't going to be pwned by a dictionary attack in 2 seconds so does this prevent against that if frames are captured? IDK.

amluto 8y ago
It attempts to. Whether or not it succeeds depends on whether the highly questionable SAE protocol actually works — see the other comments here.

sgc 8y ago

Given the apparent state of affairs, it seems like the vendor or vendors who care should bake a vpn into their firmware to provide better protection. Of course it is possible to use a pi or perhaps integrate into an open source firmware, but having a simple vendor provided config would be much better for adoption rates.

bo1024 8y ago

Wow, I hadn't realized that WiFi standards were developed like this. Looking down the page, I see a bunch of TM symbols, endorsements from massive companies, and no technical details or even attempt to describe anything related to security. Not very confidence-inspiring to an outsider.

auslander 8y ago

Security of Wi-Fi will always be a shit show, because standards are not public. Want to dig into TLS? RFCs are on internet, ietf.org, in nice courier fonts. Want to dig into WPA2? IEEE wireless security standards carry a retail cost of hundreds of dollars to access, and costs to review multiple interoperable standards can quickly add up to thousands of dollars [0] "IEEE working groups are a closed industry process." [0] www.wired.com/story/krack-wi-fi-meltdown-open-standards/

auslander 8y ago

Revolution is needed. Let IETF take over development of Wi-Fi standards. If it's patents rigged, start from scratch.