Dell AP-92, W- AP92, W-AP105, AP-175, AP-93, W-AP93, W-AP175, AP-105 manual WPA2-PSK

Page 34

Authentication

Mechanism Strength

Mechanism

 

 

 

Wireless Client

For WPA2-PSK there are at least 95^16 (=4.4 x 10^31) possible

WPA2-PSK

combinations. In order to test a guessed key, the attacker must complete the

(Wireless Client

4-way handshake with the AP. Prior to completing the 4-way handshake, the

role)

attacker must complete the 802.11 association process. That process involves

 

 

the following packet exchange:

 

∙ Attacker sends Authentication request (at least 34 bytes)

 

∙ AP sends Authentication response (at least 34 bytes)

 

∙ Attacker sends Associate Request (at least 36 bytes)

 

∙ AP sends Associate Response (at least 36 bytes)

 

Total bytes sent: at least 140. Note that since we do not include the actual 4-

 

way handshake, this is less than half the bytes that would actually be sent, so

 

the numbers we derive will absolutely bound the answer.

 

The theoretical bandwidth limit for IEEE 802.11n is 300Mbit, which is

 

37,500,000 bytes/sec. In the real world, actual throughput is significantly less

 

than this, but we will use this idealized number to ensure that our estimate is

 

very conservative.

 

This means that the maximum number of associations (assume no delays, no

 

inter-frame gaps) that could be completed is less than 37,500,000/214 =

 

267,857 per second, or 16,071,429 associations per minute. This means that

 

an attacker could certainly not try more than this many keys per second (it

 

would actually be MUCH less, due to the added overhead of the 4-way

 

handshake in each case), and the probability of a successful attack in any 60

 

second interval MUST be less than 16,071,429/(4.4 x 10^31), or roughly 1 in

 

10^25, which is much less than 1 in 10^5.

 

 

Mesh AP WPA2

Same as Wireless Client WPA2-PSK above

PSK (User role)

 

 

 

RSA Certificate

The module supports RSA 1024 bit keys and 2048-bit RSA keys. RSA 1024

based authentication

bit keys correspond to 80 bits of security. The probability of a successful

(CO role)

random attempt is 1/(2^80), which is less than 1/1,000,000. The probability of

 

a success with multiple consecutive attempts in a one-minute period is less

 

than 1/100,000.

 

 

34

Page 33 Page 35
Image 34
Page 33 Page 35
Contents Version Feb Aruba Networks Crossman Ave Sunnyvale, CA Page AP-175 Series Aruba Dell Relationship Acronyms and AbbreviationsAP-105 Series Security Levels Physical SecurityROLES, Authentication and Services Aruba Dell Relationship IntroductionAcronyms and Abbreviations GHz IPSecPhysical Description Product OverviewAP-92 Aruba Part Number Dell Corresponding Part NumberPWR AP-92 Indicator LEDs Label Function Action StatusEnet AP-93 Label Function Action StatusAP-93 Indicator LEDs Label Function Action Status AP-105 Wireless Access Point AP-105 SeriesAP-105 Indicator LEDs Label Function Action Status AP-175 Wireless Access Point AP-175 SeriesPhysical Description AP-175 Indicator LEDs Label Function Action Status PositionPhysical Security Module ObjectivesSecurity Levels Applying TELs2 AP-92 TEL Placement AP-92 Tel placement front viewAruba AP-92 Tel placement right view 3 AP-93 TEL Placement Aruba AP-92 Tel placement bottom viewAruba AP-93 Tel placement left view 4 AP-105 TEL Placement Aruba AP-93 Tel placement top viewAruba AP-105 Tel placement left view 5 AP-175 TEL Placement Aruba AP-105 Tel placement bottom viewAruba AP-175 Tel placement back view Inspection/Testing of Physical Security Mechanisms Aruba AP-175 Tel placement top viewConfiguring Remote AP Fips Mode Modes of OperationEnable Fips mode on the AP. This accomplished by going to Configuring Remote Mesh Portal Fips Mode Configuring Remote Mesh Point Fips Mode Verify that the module is in Fips mode Operational EnvironmentLogical Interfaces Fips 140-2 Logical Interfaces Module Physical InterfaceCrypto Officer Authentication Roles, Authentication and ServicesRoles Strength of Authentication Mechanisms User AuthenticationWireless Client Authentication Authentication Mechanism StrengthWPA2-PSK WPA2 PSK ServicesCrypto Officer Services KEKPTK User ServicesPMK Eapol MICWireless Client Services Unauthenticated Services∙ FTP ∙ Tftp ∙ NTP Cryptographic Algorithms Non-FIPS Approved AlgorithmsCritical Security Parameters HmacRNG PSK AES-CCMGMK GTKSelf Tests For an AES Atheros hardware Post failure
Top Page Image Contents