Windows XP SP2 Supplicant ==> 4-Way Handshake in IBSS

27 Apr 2005 8:43 AM

Alexandr Mishagin

Hello!

From "802.11i-2004.pdf" specification:
8.4.8 RSNA key management in an ESS

The key confirmation handshake is implemented by the 4-Way Handshake.

8.4.9 RSNA key management in an IBSS

To establish a security association between two STAs in an IBSS, each STA's
SME must have an accompanying

IEEE 802.1X Authenticator and Supplicant. Each STA's SME initiates the 4-Way
Handshake from

the Authenticator to the peer STA's Supplicant (see 8.4.7). Two separate
4-Way Handshakes are conducted.

I use Ethereal sniffer, to capture WiFi packets. In first case 4-Way
Handshake is exist (EAPOL-Start packet + 4 EAPOL-Key packets (4-Way
Handshake) + 2 EAPOL-Key packets (Group Key Handshake)), but in second case
there is no 4 way handshake. In both cases connection is successfully
established (and working). In first case i use WPA-PSK+TKIP, in second
WPA-None+TKIP.

Environment:
1. Windows XP SP2 eng
2. Sitecom 100g+ Access Point
3. Sitecom PCI 100g+ WiFi adapter
4. Sitecom PC Card 100g+ WiFi adapter

Question: Why does in second case Windows XP Supplicant not use 4 way
handshake?

Thanks!

27 Apr 2005 9:07 AM

Niklas

When using WPA-None (ad-hoc) there is no authenticator, the key material is
the PMK (the hash of the SSID and password)

Show quoteHide quote

"Alexandr Mishagin" <spa***@au.ru> wrote in message
news:OXHYWUwSFHA.2996@TK2MSFTNGP15.phx.gbl...
> Hello!
>
> From "802.11i-2004.pdf" specification:
> 8.4.8 RSNA key management in an ESS
>
> The key confirmation handshake is implemented by the 4-Way Handshake.
>
> 8.4.9 RSNA key management in an IBSS
>
> To establish a security association between two STAs in an IBSS, each
> STA's SME must have an accompanying
>
> IEEE 802.1X Authenticator and Supplicant. Each STA's SME initiates the
> 4-Way Handshake from
>
> the Authenticator to the peer STA's Supplicant (see 8.4.7). Two separate
> 4-Way Handshakes are conducted.
>
>
> I use Ethereal sniffer, to capture WiFi packets. In first case 4-Way
> Handshake is exist (EAPOL-Start packet + 4 EAPOL-Key packets (4-Way
> Handshake) + 2 EAPOL-Key packets (Group Key Handshake)), but in second
> case there is no 4 way handshake. In both cases connection is successfully
> established (and working). In first case i use WPA-PSK+TKIP, in second
> WPA-None+TKIP.
>
> Environment:
> 1. Windows XP SP2 eng
> 2. Sitecom 100g+ Access Point
> 3. Sitecom PCI 100g+ WiFi adapter
> 4. Sitecom PC Card 100g+ WiFi adapter
>
> Question: Why does in second case Windows XP Supplicant not use 4 way
> handshake?
>
> Thanks!
>
>

27 Apr 2005 9:48 AM

Alexandr Mishagin

Hello

"Niklas" <nikl***@hotmail.com> wrote in message
news:exm5NiwSFHA.3056@TK2MSFTNGP14.phx.gbl...
> When using WPA-None (ad-hoc) there is no authenticator, the key material
> is the PMK (the hash of the SSID and password)

Do you mean that PTK == PMK in this case?

28 Apr 2005 6:01 AM

Niklas

Since there is no authenticator you can't create a PTK, you don't have an
ANonce.
Look at the key material windows set with OID_802_11_ADD_KEY.

Show quoteHide quote

"Alexandr Mishagin" <spa***@au.ru> wrote in message
news:%23j6EC5wSFHA.2124@TK2MSFTNGP14.phx.gbl...
> Hello
>
> "Niklas" <nikl***@hotmail.com> wrote in message
> news:exm5NiwSFHA.3056@TK2MSFTNGP14.phx.gbl...
>> When using WPA-None (ad-hoc) there is no authenticator, the key material
>> is the PMK (the hash of the SSID and password)
>
> Do you mean that PTK == PMK in this case?
>
>