2

One known problem with WPA2 is that anybody who knows the preshared key can snoop on the handshake and decrypt all subsequent traffic between any parties on the network. In the typical coffee shop scenario, where anybody who is willing to pay $2 for a coffee can get the PSK, this is a big problem.

Could Diffie-Hellman be used to mitigate this problem? In my understanding, what DH boils down to is a way for two parties to share a key without ever having to send it over the wire. Or as Wikipedia puts it:

Diffie–Hellman Key Exchange establishes a shared secret between two parties that can be used for secret communication for exchanging data over a public network.

So my questions are:

  • Could DH be used to stop people who knows the PSK from snooping on your WiFi?
  • Are there any downsides to this that explains why it is not used in WPA2-PSK?
  • Are there any WiFi protocols that uses a solution like this?
Improve this question
1
  • 2
    Have a google for EAP-EKE
    – paj28
    May 24, 2016 at 11:39

1 Answer 1

Reset to default
2

In creating WPA2-AES, priority was given to 1) using the passphrase to ensure that the client was authorized to use the system, and 2) ensuring that there was no way for the client to inadvertently expose the passphrase to someone posing as the host. It succeeds at these two things. It was not created with the intention of providing full secrecy between clients, since they are often sharing the same layer two network anyway.

As your summary states, DH is designed for establishing an encrypted tunnel between any two hosts via a handshake that is (at this point) invulnerable to third party snooping. It does not provide authentication however. In order for WPA2 to take advantage of this it would need to execute the entire DH exchange, and then perform the WPA2 4-way handshake so that it can authenticate the client while still making it impossible for a malicious host to pick up the passphrase from an unsuspecting client trying to connect. However, in executing the DH exchange the client still hasn't validated the host. It would still be possible for a man in the middle to pose as the host, perform the DH exchange, and then pass the encrypted traffic on to the actual WPA2 host to perform the 4 way handshake, rendering the additional DH step useless.

WPA2-enterprise (using 802.1x and radius) allows for each client to create a passphrase and ultimately a key that is unique to their connection, providing inter-client secrecy.

Improve this answer
3
  • Thanks for the answer! Do I read you right if I say that DH could be used to prevent a passive MitM attack, but not an active one?
    – Anders
    May 24, 2016 at 20:39
  • @Anders Yes DH is designed to stop listener attacks because its not possible to reconstruct the keys by observing the traffic, but it is not an authentication system so it has no inherent resistance to active MITM (this is usually done with certificates)
    – Jeff Meden
    May 25, 2016 at 12:43
  • I think DH could be used to exchange the PTK. So it would be a part of the 4 way handshake. It's still possible to use malicious evil twin hotspot, but it still better than now
    – Sibwara
    May 22, 2018 at 16:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .