What are the security implications of pairwise master key caching in Wireless Networks?

Question

I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching. I've found lots of vendor information about it, and understand that the client does not need to reathenticate to the access point during the caching period. Does anyone know what the likely attack scenarios for this are, and what the real risk is?

Answer 1

With WPA in general, the EAP exchange results in dynamically encrypted session - one that has a different "key" for every client, and every connection, and every re-connection. PMK caching is typically found in networks that have roaming features enabled and time-sensitive applications (e.g., VOIP) - applications that can't risk disconnection because the client has to re-authenticate to the AP every time it roams.

So the risk isn't really very high. The first "phase" of security in a WPA2 Enterprise network is the authentication that occurs with the certificates (hopefully you're using mutual authentication). After a client has successfully authenticated with an AP, the EAP four-way handshake occurs, and the second "phase" of security kicks in. This second "phase" is what's cached by the AP (PMK). Depending on how long you tell your AP software to cache it for, it "forgets" the cached credentials if the client doesn't reconnect to it in the required time frame. It will basically assume the client has found a better AP and remove the cached PMK. If the client reconnects to it after the expiration time frame, it will require the EAP process to occur again, and will cache the credentials again.

As an analogy, it's like an ex-girlfriend (or boyfriend) that found someone better and left. After a certain period of grieving, you forget about them. They realize they never should have left, but if they want to be with you again, they'll have to start all over.

Edit: As for attack scenarios, it's still in a much better place than WPA2-PSK. If an attacker somehow obtains the legitimate client certificates and is able to authenticate to the WPA2-Enterprise wireless network anyway, PMK caching will be the least of an admin's concerns. Not taking into account stolen credentials, an attacker is basically looking at brute-forcing AES - something that's not an option time-wise for most attackers (thousands or millions of years to crack with today's technologies - time calculator here).