15

Shortly: I am working on a project in which several IoT devices are connected to a WPA2 password and MAC filtering protected hotspot. Can the communication in this network be leaked since I do not use TLS?

I do not want to use TLS since the resources of my IoT devices are really limited, and implementing TLS would occupy much of them. Therefore, I want to create a private WiFi network, with WPA2 password protection and MAC address filtering, so I can ensure that only devices that I allow are connected. The only question in my mind is, can the information sent over this network be stolen? Does password protection only stops foreign devices to join network or does it encyrpt the data as well?

PS: My private WiFi network has no internet connection, it's just Access Point+IoT devices.

9
  • 4
    Ultimately, as with all security questions, you need to take a risk-based approach. A determined enough attacker will always be able to steal your data. You nee to assess the likelihood of your data being stolen, and what is the impact.
    – JeffUK
    Jul 17, 2017 at 16:40
  • 2
    What threats are you trying to mitigate? For example, a client who has connected to the WiFi will be able to read everything unencrypted. If you trust that no unauthorized users are connected to your network, then you are probably okay. If you adopt a "no privileged network positions" stance (which I would argue you should do), then you need to use TLS even inside your network. You'd be surprised how many resources your IoT devices really have. Jul 17, 2017 at 20:13
  • @ChristopherSchultz Nice point. I think I didn't emphasize, my network has only IoT devices nothing else and they are trustable. Jul 17, 2017 at 20:15
  • I am just concerned if something totally untrustable and not part of my IoT network can read information shared between IoT devices. Jul 17, 2017 at 20:16
  • So the question is really about wireless signal interception, then? Jul 17, 2017 at 20:18

3 Answers 3

25

Although messages sent over wi-fi are encrypted with a session key, a device that already knows the pre-shared key can decipher the traffic. WPA doesn't implement Forward Secrecy, therefore by owning the pre-shared key anyone can decrypt all the traffic which is not encrypted by upper OSI layer protocols (say, TLS).

Therefore, when transferring sensitive data you should use an external data protection mechanism - for example, TLS.

7
  • 1
    WPA doesn't implement Forward Secrecy Is this true also for WPA Enterprise?
    – Martin
    Jul 17, 2017 at 13:48
  • 6
    WPA2-Enterprise uses asymmetric cryptography (with EAP-TLS) and unique key is used per each client and per each authentication session, so if someone steals the key, only particular user is affected. There is no way to decrypt other sessions, or previously captured packets. However, WPA2-Enterprise authentication will use digital certificates for RADIUS. And client certificates may be used as well (EAP-TLS).
    – Crypt32
    Jul 17, 2017 at 14:14
  • 2
    Yes, these are different authentication mechanisms. PSK uses pre-shared key, Enterprise uses external authentication server (RADIUS).
    – Crypt32
    Jul 17, 2017 at 19:29
  • 1
    @Crypt32 Ah, sorry, I should have been clearer: is there any security difference between WPA2-PSK and WPA-PSK?
    – Andrea
    Jul 17, 2017 at 20:03
  • 1
    Check this thread: networkengineering.stackexchange.com/a/27848
    – Crypt32
    Jul 17, 2017 at 20:07
8

So, all I need to extract anything from your network is the single network key thats stored on all devices... Makes it pretty easy to intercept and manipulate your IoT devices. Better use TLS in an End-to-End configuration.

But to answer your question about WiFi, the connection you setup with your endpoint will have some level of encryption. enough to prevent most kind of drive-by abuse. but not enough to prevent determined individuals to decrypt your communication. The strength of the enciphering is dependent on the length of the key used to encrypt the channel (so a longer passwords would yield a better protected channel)

MAC filtering is only useful in networks that rarely connect (since any message in the network form a device will leak its MAC).

It is almost always better to invest the few dollars needed to include a TLS-chip or Software module. as an example you can check out this site that is targeted at IoT makers.

So in conclusion, while WiFi does employ encryption it is not good enough to rely sole upon for data integrity or abuse. your solution will most likely require a TLS component for its security.

2
  • I think you meant to say "MAC filtering is only useful in networks where clients never connect..."
    – gowenfawr
    Jul 17, 2017 at 12:28
  • 1
    Well, yes and no. in a network where clients never connect you do not need a network. but yes its only useful when there is almost no traffic. (so like less than 0.01% of the time the network is being used by any client in it.
    – LvB
    Jul 17, 2017 at 13:02
2

When patient data is involved, HIPAA/HITECH (in the US, similar laws elsewhere) requires that data-in-motion be encrypted. You could argue, reasonably, that WiFi encrypts the signal and therefore you are covered.

If I were personally performing an evaluation of your deployment, I would argue that the data is only encrypted through the WiFi segments of the network, which isn't sufficient protection. Nothing is stopping the data from being routed through non-WiFi network segments and therefore you must not rely solely on WiFi encryption. It's also possible to disable (or render ineffective) WiFi encryption while TLS will definitely function.

As others have said, gaining access to the network will trivially allow an unauthorized client to see any otherwise unencrypted traffic to be captured. Use of TLS prohibits this attack vector.

While you may be able to survive a lawsuit based upon the claim that "WiFi is encrypted, so we are fine," I would never pay for a solution which relies solely on WiFi for encryption, and I would never allow a client to use such technology either.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .