2

Wi-Fi Protected Setup (WPS) is

a network security standard to create a secure wireless home network.

It aims at simplifying the enrollment of WiFi devices in a WiFi network (via a PIN, a button, ...).

I have a standalone AP which does not provide this functionality

  • for practical reasons (the AP is placed in possibly difficult to access places)
  • for security reasons (WPS is somehow broken (the PIN method is, and it is required by the standard to be in place, even if there is a button)).

After reading about the protocol, I have the impression that this is just a way to initially provide the connecting device the WPA2 shared key in a simpler way.
Specifically - that APs (the ones who support WPS) do not keep track of the devices enrolled via WPS because these clients are (after the WPS exchange) simply devices which hold a correct WPA2 key, similar to the ones who have been enrolled "manually" by typing in the key.
In other words, is WPS only a "WPA2 key provisioning" solution?

Am I correct with this understanding?

If yes - why aren't there (or at least I could not find any) implementations of a "standalone WPS server", a software which would have knowledge of the WPA2 key and implementing the WPS protocol, to provide WPS-only devices (or lazy users) the capacity to enroll a device via WPS? (by launching the program, going though the WPS exchnage and thus providing the device the WPA2 key which would then be used to associate with the real AP)

Improve this question

1 Answer 1

Reset to default
1

You got this right. WPS is just a way to provide the data needed to access the AP over WPA2.

Why WPS is insecure

WPS itself is insecure. This is because the PIN which is 8 digits long is split up in two parts. The first part is 4 digits long and the second part is 3 digits long. This means instead of 99.999.999 possible combinatins you only have to try 10.998 (9999 for the first 4 digits and 999 for the last 3 digits) combinations. This is what tools like reaver do: Bruteforcing the WPS PIN.

There are mechanisms to prevent this like delays between attampts and blocking addresses that got the PIN wrong n times but in the end it's just a matter of time till the PIN is guessed.

Why there arent WPS Servers

The capability of a AP to accept WPS authentification is braodcased in so called beacon packets. These packets are send by the AP continiously and contain a lot of metadata about the provided network(s). As the AP is the instance telling someone that WPS is available there can't be any outside servers. Also it wouldn't be a good idea to implement such thing because WPS would still be insecure to use.

Improve this answer
1
  • I am not sure to understand the second part: what is specific in the beacons sent by the AP, as opposed to the same ones sent by a standalone application? All in all the only thing which happens at the end is the provisioning of a WPA2 key. I leave the insecurity of WPS aside - but it would be greatly reduced by such WPS-on-demand approach.
    – WoJ
    Feb 12, 2016 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .