Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much.

Ignoring this, my question is about how to derive the 40-bit or 128-bit key from an ASCII string: this used to be platform-specific. In other words, you could enter the 40 or 128-bit key in hex form (which worked no matter the platform) or you could enter it as an ASCII phrase, which would then be turned into the underlying WEP key in some platform-specific manner, and sometimes incompatibilities would arise.

Nowadays, it seems like ASCII passwords are universal and things always work. Can someone explain how this works? Is there a standard you can point me to?

share|improve this question

2 Answers 2

WPA2 is specified by IEEE 802.11i-2004 [pdf]. I think what you are looking for is in section H.4, "Suggested pass-phrase-to-PSK mapping" on page 165.

share|improve this answer

When you're talking about typing in text for a pre-shared key in WPA2, a reccomendation for a passphrase to key mapping is described at http://tools.ietf.org/html/rfc4764#appendix-A. Alternately, a random 128 bit key is usable (and preferred -- the RFC itself states that using a passphrase is discouraged).

The actual commonly used implementation differs from that RFC a slight bit as described in the 802.11i standard. The password is hashed using HMAC-SHA1 with the HMAC key being the network SSID. It is passed through the PBKDF2 algorithm 4096 times to generate a 256 bit key.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.