3

When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much.

Ignoring this, my question is about how to derive the 40-bit or 128-bit key from an ASCII string: this used to be platform-specific. In other words, you could enter the 40 or 128-bit key in hex form (which worked no matter the platform) or you could enter it as an ASCII phrase, which would then be turned into the underlying WEP key in some platform-specific manner, and sometimes incompatibilities would arise.

Nowadays, it seems like ASCII passwords are universal and things always work. Can someone explain how this works? Is there a standard you can point me to?

Improve this question

2 Answers 2

Reset to default
3

WPA2 is specified by IEEE 802.11i-2004 [pdf]. I think what you are looking for is in section H.4, "Suggested pass-phrase-to-PSK mapping" on page 165.

Improve this answer
3

When you're talking about typing in text for a pre-shared key in WPA2, a reccomendation for a passphrase to key mapping is described at https://www.rfc-editor.org/rfc/rfc4764#appendix-A. Alternately, a random 128 bit key is usable (and preferred -- the RFC itself states that using a passphrase is discouraged).

The actual commonly used implementation differs from that RFC a slight bit as described in the 802.11i standard. The password is hashed using HMAC-SHA1 with the HMAC key being the network SSID. It is passed through the PBKDF2 algorithm 4096 times to generate a 256 bit key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .