Re: Mismatch encryption WPA on router and Vista

microsoft.public.windows.networking.wireless

3 Oct 2007 9:11 PM

tony geudens

I have a similar mismatch between my router's encryption and the one of
Windows Vista trying to connect to it. Anyone has a solution?

So on my wireless router (D-Link DI-524UP 802.11g) i have chosen WPA2-PSK
(non-broadcasting) encryption.
When trying to connect to it via Windows Vista - I see my WiFi network - but
fail to connect: in the Network properties I have selected (in security)
WPA2-personal (which according to the previous messages equals WPA2-PSK) -
but then it only gives me AES or TKIP options. When selecting AES and i add
the 'network security key' - it still doesn't work.

Why is this? Is it because the router is WPA2-PSK (without AES) and Vista
only offers WPA2-PSK with AES encryption type? What can i do about it?

"Jack (MVP-Networking)." wrote

Show quoteHide quote

> WPA-AES is the current version of WPA2, if your Wireless card on the Laptop
> is Not WAP2 compatible chose WPA-AES.
> From the weakest to the strongest, Wireless security capacity is.
> No Security
> MAC______(Band Aid if nothing else is available).
> WEP64____(Easy, to "Brake" by knowledgeable people).
> WEP128___(Hard, but possible to Brake).
> WPA-PSK__(Very Hard to Brake ).
> WPA-AES__(Not functionally Breakable)
> WPA2____ (Not functionally Breakable).
> The documentation of your Wireless devices (Wireless Router, and Wireless
> Computer's Card) should state the type of security that is available with
> your Wireless hardware.
> All devices MUST be set to the same security level using the same pass
> phrase.
> Therefore the security must be set according what ever is the best possible
> of one of the Wireless devices.
> I.e. even if most of your system might be capable to be configured to the
> max. with WPA2, but one device is only capable to be configured to max . of
> WEP, to whole system must be configured to WEP.
> If you need more good security and one device (like a Wireless card that can
> do WEP only) is holding better security for the whole Network, replace the
> device with a better one.
> Wireless Security - http://www.ezlan.net/Wireless_Security.html
> Jack (MVP-Networking).
>

3 Oct 2007 10:08 PM

Lem

tony geudens wrote:
Show quoteHide quote

> I have a similar mismatch between my router's encryption and the one of
> Windows Vista trying to connect to it. Anyone has a solution?
>
> So on my wireless router (D-Link DI-524UP 802.11g) i have chosen WPA2-PSK
> (non-broadcasting) encryption.
> When trying to connect to it via Windows Vista - I see my WiFi network - but
> fail to connect: in the Network properties I have selected (in security)
> WPA2-personal (which according to the previous messages equals WPA2-PSK) -
> but then it only gives me AES or TKIP options. When selecting AES and i add
> the 'network security key' - it still doesn't work.
>
> Why is this? Is it because the router is WPA2-PSK (without AES) and Vista
> only offers WPA2-PSK with AES encryption type? What can i do about it?
>
> "Jack (MVP-Networking)." wrote
>
>> WPA-AES is the current version of WPA2, if your Wireless card on the Laptop
>> is Not WAP2 compatible chose WPA-AES.
>> From the weakest to the strongest, Wireless security capacity is.
>> No Security
>> MAC______(Band Aid if nothing else is available).
>> WEP64____(Easy, to "Brake" by knowledgeable people).
>> WEP128___(Hard, but possible to Brake).
>> WPA-PSK__(Very Hard to Brake ).
>> WPA-AES__(Not functionally Breakable)
>> WPA2____ (Not functionally Breakable).
>> The documentation of your Wireless devices (Wireless Router, and Wireless
>> Computer's Card) should state the type of security that is available with
>> your Wireless hardware.
>> All devices MUST be set to the same security level using the same pass
>> phrase.
>> Therefore the security must be set according what ever is the best possible
>> of one of the Wireless devices.
>> I.e. even if most of your system might be capable to be configured to the
>> max. with WPA2, but one device is only capable to be configured to max . of
>> WEP, to whole system must be configured to WEP.
>> If you need more good security and one device (like a Wireless card that can
>> do WEP only) is holding better security for the whole Network, replace the
>> device with a better one.
>> Wireless Security - http://www.ezlan.net/Wireless_Security.html
>> Jack (MVP-Networking).
>>

Does your Vista computer connect to your router if you disable all
security on both the router and the computer?

I'm not sure what you mean by "(non-broadcasting)." If you mean that
you have disabled SSID broadcast, you should re-enable it. Disabling
SSID broadcast is not an effective security measure and may lead to
problems.

As originally envisioned, both WPA and WPA2 incorporate a RADIUS server
to generate, rotate, and distribute shared keys. This approach
guarantees that shared keys are changed very frequently, and makes the
encryption very difficult, if not impossible, to crack. The problem is
that most home and small office wireless networks can't afford (or lack
the technical ability) to include a RADIUS server for their network.
Thus, both WPA and WPA2 have a "personal" mode in which the encryption
key is pre-shared (PreSharedKey=PSK) among all of the devices on the
wireless network.

Although the base key is pre-shared, WPA introduced a concept called
TKIP (Temporal Key Integrity Protocol) in which the preshared keys are
used to generate Pairwise Transient Keys that are used to encrypt the
transmitted packets. Each packet gets a new key. This makes cracking
the encryption much more difficult than WEP, in which the same key was
used until manually changed.

The keys are used to encrypt and decrypt the packets of information
according to an encryption algorithm. As originally implement, WPA used
the same algorithm as WEP -- RC4. This is not a particularly secure
algorithm.

WPA2 implements a much more secure algorithm -- AES (Advanced Encryption
Standard). Before WPA2 hardware was widely available, some wireless
device manufacturers included the option with WPA to use AES. This
WPA-AES is, for practical purposes, about the same as WPA2.

Given all of that, if you set your DI-524UP to use WPA2-PSK, the adapter
in your Vista computer should be set to WPA2-personal-AES.

Make very sure that you copy the passphrase EXACTLY when you enter it
into your computer. It is case sensitive. Try setting your router to
use a simple passphrase, say 123456, just to see if you can establish a
working connection. If that works, then you can change the passphrase
to something more appropriately complex.

--
Lem -- MS-MVP - Networking

To the moon and back with 64 Kbits of RAM and 512 Kbits of ROM.
http://en.wikipedia.org/wiki/Apollo_Guidance_Computer