Jagetia, M

Kocak, T

English

Internet enabled wireless devices continue to proliferate and are expected to surpass traditional Internet in the near future. However, data security and privacy remain major concerns in the current generation of wireless connectivity. The wired equivalent privacy (WEP) protocol used within the 802.11 standard has "major security flaws" thus WLANs using the protocol are vulnerable to attacks. We propose a scrambling algorithm that reduces the vulnerability of the WEP. Both the software and hardware implementations of the algorithm reveal at least 10,000 times improvement in securit

Explore Bristol Research

                          Jagetia, M., & Kocak, T. (2004). A novel scrambling algorithm for a robustWEP implementation [wired equivalent privacy protocol]. IEEE 59thVehicular Technology Conference, 5, 2487 - 2491.10.1109/VETECS.2004.1391370Link to published version (if available):10.1109/VETECS.2004.1391370Link to publication record in Explore Bristol ResearchPDF-documentUniversity of Bristol - Explore Bristol ResearchGeneral rightsThis document is made available in accordance with publisher policies. Please cite only the publishedversion using the reference above. Full terms of use are available:http://www.bristol.ac.uk/pure/about/ebr-terms.htmlTake down policyExplore Bristol Research is a digital archive and the intention is that deposited content should not beremoved. However, if you believe that this version of the work breaches copyright law please contactopen-access@bristol.ac.uk and include the following information in your message:• Your contact details• Bibliographic details for the item, including a URL• An outline of the nature of the complaintOn receipt of your message the Open Access Team will immediately investigate your claim, make aninitial judgement of the validity of the claim and, where appropriate, withdraw the item in questionfrom public view.A Novel Scrambling Algorithm for a Robust WEP Implementation Mohit Jagetia and Taskin Kocak, Department of Electrical and Computer Engineering, University of Central Florida, Orlando, FL 328 16-2450. e-mail: tkocak@cpe.ucf.edu. Abstract- Internet enabled wireless devices continue to proliferate and are expected to surpass traditional Internet in the near future. However, data security and privacy remains major concerns in the current generation of wireless connectivity. Wired Equivalent Privacy (WEP) protocol used within the 802.11 standard has “major security flaws” thus WLANs using the protocol are vulnerable to attacks. I n  this paper, we propose a scrambling algorithm that reduces the vulnerability of the WEP. Both the software and hardware implementations of the algorithm reveal at least 10,000 times improvement in security. Keywords: wireless LAN, 802.11, security, WEP. I. INTRODUCTION Wireless technology has become an integral part of today’s life. The use of wireless networking is rapidly rising with an ever-increasing need for businesses to cut costs and to provide mobility to workers. The wireless technology has spread to devices from small-embedded systems to large general purpose PCs. This is due to cheaper prices, faster speeds and also due to the need for greater mobility. It is desirable to have as much data privacy as possible. Hence in today’s networked world security is at a premium. Wireless network is very essential, as it is not bound to any region. Any unauthorized person can read, change or use the private data. Wired equivalent privacy (WEP) is a security protocol, specified in the IEEE Wireless Fidelity (Wi-Fi) standard, 802.11 [I], that is designed to provide a wireless local area network (WLAN) with a level of security and privacy comparable to what is usually expected of a wired LAN. WEP seeks to establish similar protection to that offered by the wired network‘s physical security measures by encrypting data transmitted over the WLAN. Data encryption protects the vulnerable wireless link between clients and access points; once this measure has been taken, other typical LAN security mechanisms such as password protection, end-to-end encryption, virtual private networks (VPNs), and authentication can be put in place to ensure privacy. However, WEP has “major security flaws” thus WLANs using the protocol are vulnerable to attacks [2,3]. These so called wireless equivalent privacy attacks show themselves in the form of intercepting and modifying the transmissions, and gaining access to restricted networks. In this paper, we propose an algorithm to patch WEP protocol against these attacks. ~7803-8255-2/o4p$u).OO 82004 IEE. 2487 11. THE PROBLEM STATEMENT AND OUR APPROACH WEP uses RC4 enclyption algorithm [4], which operates by expanding a short key into an infinite pseudo-random key stream. If an anacker flips a bit in the cipher text, then upon decryption, the corresponding hit in the plaintext will be flipped. If an eavesdropper intercepts two cipher text encrypted with the same key stream, it is possible to obtain the XOR of the two plaintexts. Knowledge of this XOR can enable statistical attacks to recover the plaintexts. The statistical attacks become increasingly practical as more cipher text that use the same key stream are known. Once one of the plaintexts becomes known, it is trivial to recover all of the others. To ensure that a packet has not been modified, WEP uses,an Integrity Check Value (ICV) field in the packet. To avoid encrypting two cipher text with the same key stream, an initialization vector (IV) is used to augment the shared key and produce a different RC4 key for each packet. The major attacks to WEP are given as follows: 1. Active attack Modification of the packet by mod/fying the ICV. 2. Passive attacks: a. b. Integrity violation by analyzing the IV Table based attack for decrypting every packet that is sent over the wireless link. In order to avoid these attacks, we propose a novel Scrambling algorithm, which randomize the data from the unauthorized user by adding some standard randomness to it. This random characteristic is a function of the private attribute shared between transmitter and receiver only. In this approach the randomness is achieved by RC4 algorithm and distribution of randomness is provided with different algorithms to increase the complexity of rectifying the encrypted data and optimize utilization of randomness. A .  The Algorithms In the Scrambling, Algorithm (SA), a random octet is inserted in a random position. The random position is obtained by RC4 as a function of the secret key. Currently, the octets contain random information, however, we are in the process of developing ways to utilize these octets for further improvement in security of the packets (e.g., dynamically changing secret keys (TUP)). Octet insertion as shown in Fig.1 is applied to three different fields in the packet format, namely, ICV, IV and Authorized licensed use limited to: UNIVERSITY OF BRISTOL. Downloaded on July 9, 2009 at 05:27 from IEEE Xplore.  Restrictions apply.2 4  R 16 X-I 6-8-4-2+5 Bvtes Figure I : Packet formats for the WEP and modified WEP by the scrambling algorithm cipher text , to reduce the vulnerability for each of the attacks mentioned above. One octet is inserted for both ICV and IV. However, due to the length and to improve the security, more octets are inserted to the cipher text. In the cipher text, the SA distribute the random octets at random positions in such a way that density of octets reduces along with the length of the packet, which ensures insignificant increase in the packet size for large packets. Each field (IV, cipher text , ICV) uses one RC4 key-stream octet, to find random position for insertion of random octet. Thus every packet requires 3 RC4 octets from key-stream, so the key stream is divided in set of 3 octets and one set is used for one WEP frame. We have two major algorithms for inserting the random octet at a random position. Algorithm 1, which is used to randomize IV and ICV; is using 5 lower bits of first octet from a set to randomize IV and 5 lower bits of third octet to randomize ICV. Depending upon the value of these 5 bits it inserts random octet in IV and ICV. Alporithm I :  IV and ICV randomizations i extraction For entire transmission Fetch packet-number and IV/ICV from 802. I I protocol Fetch random data content for the octetfiom memory Calculate~randomgosition(RC4(secret~kw) [ i *packet-nurnher]~ield-leugth) Insert/Extract the octet at the calculated random position End for where i is the number of RC4 octets used per packet for randomness. Algorithm 2 is using the second octet of the set to randomize cipher text. The distrihutiveAlgorithm used in Algorithm2; uses the LSBs of octet to find the random point in the chunk. Random point is the offset of insertion point in the chunk. The size of the chunk is increased exponentially to utilize the different panems of the second octet and to create high random density at the starting of the cipher field (explained in section IV). distributiveAlgorithm ensures the insertion of the random octet at the random position throughout the chunk, which is always in the range of 0 to cument chunk size. A chunk is a portion of input stream whose size is increasing logarithmically and dependent on the chunk number or chunk position. Each chunk is 2 times in size of its previous chunk and the first chunk is 1 byte wide. This is because every time the random pointer is pre-pended with one bit to point the random position, which results in twice as many points as by the earlier one, so the size is doubled every time. If pre-pending is not binary but rather octal or hex then chunk sizes will be 8 times or 16 times ofits predecessor. Algorithm 2: Cipher text randomization and extraction Fetch packetnumherfiom 802.1 I protocol Reset Cipher-octet-cntr to 0; Reset octetsgrocessed to 0; While not end ofthe cipher text For Entire transmission If(randomgosition == current_position) then WEP input Scrambled WEP output Access to RC4 octets, Control signals Figure 2: Architecture of the implemented algorithm for scrambling 2488 Authorized licensed use limited to: UNIVERSITY OF BRISTOL. Downloaded on July 9, 2009 at 05:27 from IEEE Xplore.  Restrictions apply.. .. . . . , , Figure 3: Ciphertext randomization /* (randomgosition = distributiveAlgorithm (No-of-insertedoctets, packet-number)) = Cipher-octet-cntr *I (Fetch random data content for  the octet ftom memoT AND Insert /he octet in the current position) OR (Remove the current octet from stream) ocatsgrocessed = octetsgrocessed+ I ;  End if Insert an octet of cipher text ; Cipher-octet-cntr = Cipher-oc/et-cntr + I ;  Fetch next cipher octet: End while End For SubProc: Return pos distributiveAlgorithm (No_of_inserted_octets, packet-number) pos = RC4(secret-key)[packet-number*i+2][0 to No-of-inserted-octets] I* packet-number*i+2 points to the second octet among the current set of RC4 octets used ' I  End SubProc; B. Scrambling Performing the insert action in the above algorithms results in the scrambling of the original WEP cipher text . This action causes the insertion of the random octet at the random position obtaincd from the distributiveAlgorithm. Insertion could be the part of another protocol enhancing security or other robustness, but must not be the function of Secret Key, because combination of scrambling algorithm and it may cause major leak of secret key information. C. DeScrambling Performing the extract action in the above algorithms results in the Descrambling of the scrambled WEP cipher text. Tbc extracted octet is then made available for other processors if used for other enhancements. 111. IMPLEMENTATION OF THE ALGORITHMS The cipher text is randomized in decreasing density of randomness. We are dividing cipher text into virtual chunks of different sizes and adding random contents at random positions in each chunk. The size of a chunk is determined by 2'"'""k "umber) We have implemented the proposed algorithm in MATLAB to verify the functionality at the system level. Furthermore, the algorithm is behaviorally modeled in VHDL to obtain hardware simulation and verification. The architecture of the implemented scrambling algorithm is given in Fig.2. The algorithm works as a post-processor to the WEP protocol. It takes the WEP input and applies randomness to it as specified in section 2. In the architecture, BAB (Bit Addressable' Memory Bank) has 2 banks of bit addressable memory. Bank 1 is, of size 32 bits, used to hold input WEP content either IV Authorized licensed use limited to: UNIVERSITY OF BRISTOL. Downloaded on July 9, 2009 at 05:27 from IEEE Xplore.  Restrictions apply.or ICV. Bank 2 is, of size 48 bits, used to hold the resultant randomized output of IV or ICV. Cntr 1 is used to point bits in Bank 1 for the IV starting of the packet and decreases across the length of the packet. Random insertion positions in above test simulation are calculated by the controller (shown in architecture), which has access to RC4 octets from WEP implementation. In the above test, the RC4 octet has a binary value of “0001 1100”. The last bits of the obtained RC4 octet are used to give different positions in the mth chunk between the range of 0 and the maximum chunk size. The dashed region in Fig. 3 is zoomed in Fig. 4 to illustrate the insertion of random octet in details. In every clock cycle, input is read and forwarded to output if the current state is “read-inpgort” state. When the current state is “insert” state, a control signal is sent to FIFO to wait for a clock cycle; in which the system inserts the random content. Iv. ANALYSIS OF THE SCRAMBLING ALGORITHMS Notation: n: number of bytes (octets) received as WEP cipher text N: number of bytes (octets) result of application of SA Cs: chunk size Cp: chunk position Ro: number of random octets d h :  density of random octets Algorithm 1 : Insertion of an 8-bit random octet in 24-bit IV at any random position, obtained from Calculate-randomgosition function, results in 6,144 (24’28) different patterns of the same IV. This means an attacker needs to analyze 6,144 more patterns to decrypt the message in case of an IV collision. Thus, the improvement in security is 6,144 times for IV based attacks. The same improvement in the ICV based attacks is 8,192 (32*28) times as ICV is 32 bits long. Algorithm 2: Calculation of achieved randomization: We insert 1 octet per chunk thus No of octets inserted = N o  of chunks processed. No of chunks processed = I+log,(number of cipher text octets processed) Cp as a function of incoming octets can be written as cp(n) = ceil(log,(n)) (1) Each insertion has s positions among which one has to he selected randomly where s = chunk size. Before applying the algorithm, the size of a chunk at position Cp can be calculated as c s  tc,) = 2cp (2) Since every chunk has one random octet in it, the total number of random octets inserted can be given as Ro(n)  = 1 + C,(n) ( 3 )  randomization(Cs) = Cs*28 (41 For each chunk obtained randomization is: For C, chunks the total randomization will be fi c, (C,) x 28 i=l which is the improvement in security for cipher text table based attacks. The density of inserted random octets in the cipher text can he given as - 5 o 0.3 B 0.2 0.1 0 Figure 5 :  Density ofrandom Dctes As depicted in Fig. 5,  the density makes a peak at the first 2 bytes of the insertion, and then it reduces logarithmically. The irregular peaks in the curve are caused by the insertion of the random octet. As it requires lesser computational power to retrieve original WEP cipher text from small number of input octets, so we used distributiveAlgorithm to keep high density of randomness at the beginning of frame and reducing logarithmically over the length of the frame. The number of octets in the modified packet will be given by N ( n )  = n + R d n )  (7) Fig. 6 illustrates the change in the cipher part of WEP packet due to the Algorithm2, which shows that for 50 input octets modified cipher will be 56 octets, and for 1024 octets it will be 1035 octets. Now, let us calculate the probability that an intruder will successhlly retrieve the cipher text stream from the scrambled WEP output. First, the probability of finding a random octet in a chunk can be given as C-78CI3-8255-2’Wu).Oo 02W4 IEE. 2490 Authorized licensed use limited to: UNIVERSITY OF BRISTOL. Downloaded on July 9, 2009 at 05:27 from IEEE Xplore.  Restrictions apply.Effective Ciphertext Size (in octets) 60 50 . -. Original 40 ......... ........ ........ Modified ’ /  ._ yi m r m .c 20 ......... ....... ....... ......... 0 20 30 40 50 lo Incoming ciphertext size Figure 6: The number ofoctets in the modified packet against the number of incoming wtets Then, the probability of successfully retrieving the whole cipher text (i.e., breaking the scrambling algorithm for the cipher text randomization - The probability of finding all random octets) will be (9) ,=I Probabilitv of successful retrieval of ciahertext I :  I - 2  4 n 6  8 10 Figure 1: Probability of successful retrieval of cipher text As the number of cipher text octets increases linearly, the probability of breaking the scrambling algorithm for the cipher text randomization decreases exponentially. For the packets with a cipher text of 5 octets or more, the probability becomes 0.00097 or less. Finally we calculate the computational difficulty in terms of the number of different panems generated for same data panem. Different pattems for the same 24-bit IV can be given as: CD,,, = 28 x 24 (10) 2491 Different panems for the same n data hits can be given as: CD,-(~) = 28 xlog, ( n ) x  c,(n) ( I  1) Figure 8: Computational difficulty Fig. 8 shows the increase in the requirement of computational power to recover the WEP cipher text from the scrambled cipher text. Different panems for the same ICV can be given as: CDjc, = 2’ x 32 (12) Increased total computational difficulty can be given as CD ( n )  = CD,, + CD,(n)+ CD,,,, (13) V. CONCLUSIONS A scrambling algorithm is proposed to patch WEP protocol. The algorithm is implemented in MATLAB and VHDL and is verified through simulations. Mathematically, it achieves an aggregate of at least 14848 times (6144 + 8192 + 512(for only one byte cipher text input)) improvement in WEP security. The hardware implementation of the algorithm requires only adding two counters, few registers and a simple controller. Thus the algorithm provides a robust WEP security system without substantially increasing the overall implementation cost. REF E RE N c E s [ I ]  Std802.1Ib,IEEE, 1999. [ Z I  N. Borisov, I. Coldberg. and D. Wagner, “Intercepting Mobile Communications: The lnsecurlty O f  802.1 I”, Proc. o/ /he 7th Annual hrernarional Conference on Mobile Compuring and Neworking, July 2WI.  [3] J. R. Walker, “Unsafe at any key size; an analysis of the WEP encapsulation”, IEEE Document 802.1 1-00/362, Oct. 2000. I41 The RC4 Encryption Algorithm, RSA Data Secunty, Inc., 1992. Authorized licensed use limited to: UNIVERSITY OF BRISTOL. Downloaded on July 9, 2009 at 05:27 from IEEE Xplore.  Restrictions apply.

A novel scrambling algorithm for a robust WEP implementation [wired equivalent privacy protocol]

https://research-information.bris.ac.uk/files/3016335/jagetia_IEEE_VTC_2004.pdf

A novel scrambling algorithm for a robust WEP implementation [wired equivalent privacy protocol]

Abstract

Similar works

Full text

Available Versions

Explore Bristol Research