In this video, we're going to talk
about the technologies used for encryption
on wireless networks.
Specifically on networks using WPA, WPA2, and WPA2-enterprise.
WPA stands for Wi-Fi Protected Access.
And you'll notice we're not going
to talk about WEP, which stands for Wired Equivalent Privacy.
The older WEP encryption that was used on wireless networks
was found to have some cryptographic flaws,
and therefore you should not-- and certainly probably
won't-- see WEP used on today's modern wireless networks.
We're going to focus on two types of technologies
used in WPA.
The first one we'll talk about is TKIP.
That stands for Temporal Key Integrity Protocol.
TKIP was built to rotate keys around so that there would not
be the same problems we ran into with encryption
with the WEP protocol.
And TKIP was also something that made sure
that there would be something unique about each one
of these encryption keys.
The other technology that we'll talk about
is the one we commonly see with WPA2 today,
and that is AES that is used in conjunction with CCMP.
AES is the Advanced Encryption Standard algorithm
that's doing a lot of the encryption.
And it's combined with CCMP, which
is Counter Mode with Cypher Block Chaining Message
Authentication Code Protocol.
We hardly call it that because it's so many words.
You most often see it referred to when you're setting up
your wireless network as WPA2 and in parentheses
it might have TKIP or it might say AES and CCMP.
When we ran into the cryptographic problems
with the WEP protocol, we needed something to fill the gaps,
And so we created TKIP.
This allowed us to make those 802.11 networks more
secure without worrying about the cryptographic problems
that we had with WEP.
One of the keys with TKIP is that it
makes the keys together.
It took this secret root key and mixed it
with the initialization vector.
And this made the key much more secure
because it was constantly changing.
Another nice edition of TKIP is that it
includes sequence counters.
This is useful to avoid replay attacks.
In a replay attack, someone can record the information
going over the network and then replay it again to gain access.
Instead of having you there, they
would pretend that they were you because they
were replaying your previous content.
Well, with a sequence counter, you
can't replay content because it would still
have the old counter numbers inside of it.
So this was one way to make sure that no one could
record that and then use that information later.
TKIP also implemented a 64-bit message integrity check.
This meant that information could not
be changed somewhere in the middle of the conversation.
This is a big problem if you're worried about
a man-in-the-middle attack where someone would receive
information, modify that information,
and then send it on to you.
With the message integrity check,
you can be assured that the original information is still
intact when it gets to you.
We see TKIP being used with the WPA encryption protocol.
This was the stop gap between WEP and WPA2.
With the WPA2, we chose to go a different route
with encryption.
That different route with encryption
implemented CCMP, the Counter Mode with Cypher Block Chaining
Message Authentication Code Protocol.
This is what replaced TKIP when the final WPA2
implementation was released.
This was a more advanced encryption standard.
It had a larger key size, it had a larger block size
to be able to do the encryption, and it
used a lot more computing resources.
It used encryption algorithms that required more CPU usage.
And we usually solve out this time frame that many people
had to upgrade their wireless hardware
to be able to implement WPA2.
These days, our hardware is up to date
and we generally see WPA2 used on all of our wireless devices.
There were some nice capabilities added with CCMP.
One of them was data confidentiality,
where only certain people that were authorized
to receive information across the network
could receive that data.
There's also authentication enabled within CCMP,
so you can be assured that the user on the network
really is the genuine user.
There's also access control implemented within CCMP.
So we were able to allow or disallow access
to the network based on your credentials.
If you're working with some older hardware,
you may see that it only supports WPA and not WPA2,
and therefore would only be supporting TKIP.
On newer access points and wireless devices,
you may see those supporting WPA2,
which of course would be supporting CCMP and AES.
And you may see on the newer devices
that there might be options to support some of the older
hardware, so you may also be able to even configure
the newer hardware to simply use WPA.
But as our older hardware is phased out,
these days we tend to always use WPA2,
which means we're going to be using CCMP in combination
with AES.