Aruba Networks FIPS 140-2 manual User Authentication, Wireless Client Authentication

Page 24

4.1.2 User Authentication

Authentication for the User role depends on the module configuration. When the module is configured as a Mesh AP, the User role is authenticated via the WPA2 preshared key. When the module is configured as a Remote AP, the User role is authenticated via the same IKE pre-shared key/RSA key pair that is used by the Crypto Officer. In CPSec AP mode, User authentication is accomplished via same RSA key pair that is used by the Crypto Officer.

4.1.3 Wireless Client Authentication

The wireless client role, in the Remote AP, Mesh AP or CPSec AP configuration authenticates to the module via WPA2. WEP and/or Open System configurations are not permitted in FIPS mode. In advanced Remote AP configuration, when Remote AP cannot communicate with the controller, the wireless client role authenticates to the module via WPA2-PSK only.

4.1.4 Strength of Authentication Mechanisms

The following table describes the relative strength of each supported authentication mechanism.

Authentication

Mechanism Strength

Mechanism

 

 

 

IKE shared secret

For IKE, there are a 95^8 (=6.63 x 10^15) possible preshared keys. In order

(CO role)

to test the guessed key, the attacker must complete an IKE aggressive mode

 

 

exchange with the module. IKE aggressive mode consists of a 3 packet

 

exchange, but for simplicity, let’s ignore the final packet sent from the AP to

 

the attacker.

 

An IKE aggressive mode initiator packet with a single transform, using

 

Diffie-Hellman group 2, and having an eight character group name has an

 

IKE packet size of 256 bytes. Adding the eight byte UDP header and 20 byte

 

IP header gives a total size of 284 bytes (2272 bits).

 

The response packet is very similar in size, except that it also contains the

 

HASH_R payload (an additional 16 bytes), so the total size of the second

 

packet is 300 bytes (2400 bits).

Assuming a link speed of 1Gbits/sec (this is the maximum rate supported by the module), this gives a maximum idealized guessing rate of 60,000,000,000

/4,672 = 12,842,466 guesses per minute. This means the odds of guessing a correct key in one minute is less than 12,842,466/(6.63x10^15) = 1.94 x 10^- 9, which is much less than 1 in 10^5.

24

Page 23 Page 25
Image 24
Page 23 Page 25
Contents Fips 140-2 Non-Proprietary Security Policy Page Services Aruba Dell Relationship Acronyms and AbbreviationsAruba AP-120 Series Security Levels Physical SecurityPage Introduction Aruba Dell RelationshipAcronyms and Abbreviations GHzLAN Product Overview Aruba AP-120 SeriesPhysical Description Aruba Part Number Dell Corresponding Part NumberIndicator LEDs Label Function Action Status PWREnet Label Function Action Status Module Objectives Security LevelsPhysical Security Applying TELsAruba AP-124 TEL Placement AP-124 Front viewAP-124 Back view Aruba AP-125 TEL Placement AP-124 Bottom viewAP-125 Front view AP-125 Right view Inspection/Testing of Physical Security Mechanisms AP-125 Bottom viewConfiguring Remote AP Fips Mode Modes of OperationEnable Fips mode on the AP. This accomplished by going to Configuring Remote Mesh Portal Fips Mode Configuring Remote Mesh Point Fips Mode Verify that the module is in Fips mode Operational EnvironmentLogical Interfaces Fips 140-2 Logical Interfaces Module Physical InterfaceRoles, Authentication and Services Crypto Officer AuthenticationRoles User Authentication Wireless Client AuthenticationStrength of Authentication Mechanisms Authentication Mechanism StrengthWPA2-PSK Services Crypto Officer ServicesService Description CSPs Accessed see section WPA2 PSKUser Services Service Description CSPsService Wireless Client Services Unauthenticated Services ∙ FTP ∙ Tftp ∙ NTPCryptographic Algorithms Non-FIPS Approved AlgorithmsCritical Security Parameters HmacRNG PSK PTKAES-CCM GMK GTKSelf Tests For an AES Cavium hardware Post failure
Top Page Image Contents