1

I'm currently trying to understand secure connections inside a WiFi network without an Internet connection.

I would like to use some sort of SSL tunneling inside a WiFi network between two clients.

If I have multiple clients on the same secured WiFi, say WPA2 and two clients want to communicate safely without giving the other clients a way to interfere or listen, what's the best practice? SSL tunneling inside a WiFi exposes great vulnerabilities due to methods like ARP-spoofing or IP table manipulation.

My searches on secure connections inside a WiFi had a very poor outcome. There are tons of articles on how to secure your WiFi in general or how to tunnel your connection in public WiFi networks (SSL/VPN), but is something like a tunnel inside the same network even possible?

I hope this question isn't too basic; I'm pretty new to cryptography.

Improve this question

1 Answer 1

Reset to default
3

It is true that many packets sent over Wi-Fi can be collected using ARP spoofing. Because ARP operates on the link layer of the OSI model, there's very little you can do about this.

What is currently accepted as best practice regarding Wi-Fi, is

  1. Use a properly designed security mechanism: WPA2;
  2. Use a strong pre-shared key: 15 characters at minimum and randomly generated;
  3. Switch off the Wi-Fi Protected Setup (WPS) feature.

The pre-shared key must be random because a single handshake packet pair (challenge and response) can be used to crack the key off-line by using brute-force, dictionary, and/or rainbow table attack (or a combination of these methods), facilitated by the Aircrack-ng Wi-Fi suite, for instance.

You can read more about WPA2's vulnerabilities on Wikipedia. It reveals that you should switch the Wi-Fi Protected Setup (WPS) feature off, and that using a strong and sufficiently long shared key is imperative to avoid successful cracking of the pre-shared key by using brute-force over custom hardware (Aircrack-ng running on a FPGA).

Computers communicating over a WiFi connection (client-server) use the application layer of the OSI model, like TLS/SSL (and HTTPS). Using a secure application layer communication protocol (like HTTPS), adds an additional layer of security. So if your requirement is high security, this approach is certainly recommended.

VPN operates on either the data link layer (layer 2) or network layer (layer 3) of the OSI model, depending on the protocol that's being used. So, using VPN adds yet another layer of security.

These multiple layers of security is commonly referred to as Defense in depth. Of course, it is important not to share keys between each security system. You can be sure that if a hacker breaches the first layer by cracking the key, he or she will try to use it on each subsequent layer encountered.

Improve this answer
8
  • Thank you for your in-depth answer! You shed some light on the whole situation. I looked into SSL/TLS/HTTPS, but since the wifi is not connected to the internet and I can't get a connection to a CA, certificates could be easy manipulated (sslsniff/sslstrip). Do I get this right that WPA2 encryptes the traffic between each client and the router differently using PSK, so that another client can't tap into the connection between the router and an individual client?
    – Youleean
    Commented Apr 25, 2014 at 18:19
  • As I further looked into WPA2-PSK i found this which answers my previous question about the encryption between clients in a wifi. If not Enterprise WPA2 it seems way more insecure than i thought and in my situation i can't afford Enterprise WPA2. Isn't there a standard like SSL/TLS specialy for "offline wifi" use?
    – Youleean
    Commented Apr 25, 2014 at 18:41
  • I suppose you mean "non-wireless LAN" when you say "offline Wi-Fi", Ethernet in other words. Ethernet operates on the physical layer of the OSI model, and since physical access to its infrastructure is required to interact with it, there is no physical layer security implemented. In this case, application layer security (e.g. HTTPS) is considered sufficient in most cases. As you might already know, HTTPS layers HTTP on top of the SSL/TLS protocol, so this (HTTPS) is be the standard for "offline Wi-Fi" use.
    – Steven Volckaert
    Commented Apr 25, 2014 at 19:11
  • Indeed, the answer you linked to clearly reveals the importance of keeping the PSK secret. If this isn't feasible (e.g. Wi-Fi in a corporation's headquarters), WPA2-Enterprise is indeed the way to go.
    – Steven Volckaert
    Commented Apr 25, 2014 at 19:18
  • With "offline WiFi" i meant a WiFi Network NOT connected to the internet - not Ethernet. How is it possible to use HTTPS/SSL without an Internet connection? You could never reach out to CAs to request an signed certificate. I'm not entirely sure if I can explain the situation correctly. I'm asking for a secure connection between two clients in a WiFi Network not(and never) connected to the Internet. WPA2-PSK is not sufficent due to link from my last comment and I can't meet the requirements for Enterprise WPA.
    – Youleean
    Commented Apr 25, 2014 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .