Skip site navigation (1)Skip section navigation (2)
Date:      Wed, 24 Apr 2013 16:16:32 -0400
From:      Michael Powell <nightrecon@hotmail.com>
To:        freebsd-questions@freebsd.org
Subject:   Re: Home WiFi Router with pfSense or m0n0wall?
Message-ID:  <kl9ej0$f2b$1@ger.gmane.org>
References:  <CAHieY7S9b9F1jndpkR2Drw=GCoBxmEWRs6Ot8MRjjQFH=xmHQQ@mail.gmail.com> <kl0qu9$ovo$1@ger.gmane.org> <CAHieY7SSbO+wt68PeFLYDzAtqMnR0kJ3UakOjvLkSMzVA31LbA@mail.gmail.com> <kl3vao$hbt$1@ger.gmane.org> <20130423010407.25a73c92@gumby.homeunix.com> <CAHieY7SSzuJBt6frT7QoU=EzZDA=9Fc=H-xDHYtH3PejTi5QzQ@mail.gmail.com>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
Alejandro Imass wrote:

[snip]
>>> Most consider the answer to use WPA2, which I do use too. Many think
>>> it is 'virtually' unbreakable, but this really is not true; it just
>>> takes longer. I've done WPA2 keys in as little as 2-3 hours before.
>>
>> Are you saying that any WPA2 key can be cracked or or you simply
>> referring to weak keys?
> 
> I would also like to specifically if it's for weak keys or are all
> WPA2 personal keys crackable by brute force. Also is WPA2 Enterprise
> as weak also. Could anyone expand on how weak is WPA2 and WPA2
> Enterprise or is this related to weak PSKs only??
> 

I'm just a lowly sysadmin and not any kind of crypto expert.  The problem is 
time and horsepower. While a ridiculously easy key of say 4 characters that 
is not salted may be doable on a PC, once you start to get to 8-9 characters 
or more the time it takes begins to get huge fast. It's a matter of can you 
tie up the resource long enough to wait it out. Throw salting into the mix 
and it gets longer again. 

What I do at home is concatenate 2 ham radio call signs of friends that I 
can remember. Then I sha256 that and select from the end backwards 15 
characters. This won't actually defeat the inherent weakness of using a pre-
shared key, but it will take longer for a simple brute force. You should 
also throw in additional characters from your character set beyond just 
alpha/numerics.

Also, my little tinkertoy i5-3570K overclocked up to 4.5GHz is just that - a 
toy. I can use it to generate a trace file, which I then take to work and 
replay it using a z196 when they occasionally allow me to play for bit.  I 
also have rainbow tables and dictionary word-lists pregenerated for 
cheating. Another thing people are playing with is stuffing 4 high end video 
cards in a box and using them for computation. This enhances the PC platform 
beyond just using the CPU. There are also people doing this "in the cloud". 
And they will rent you compute time for a fee.  :-)

The pre-shared key is the weakest as compared to Enterprise. Enterprise WPA 
is stronger because it is a user account based system which authenticates 
using 802.1x via a Radius server. You can even assign certificates to user 
accounts and if they don't have the cert on the client they are trying to 
connect with, it won't. Throw Kerberos re-ticketing into the mix adds 
another layer to the onion. I seem to think recalling something about 
Kerberos re-ticketing something like every 900 seconds, or something like 
that. Switches and other network equipment that supports 802.1x can also 
filter out traffic that is not authorized.

Bottom line is Enterprise is better than a simple pre-shared key. But it 
involves radius, dns/dhcp, windows domain controllers, active directory, a 
PKI infrastrucure and access points that are designed for use in this 
environment (and they cost more). So while it may be more secure than a 
simple pre-shared key, it is simply not practical for the home user as they 
won't have all the 'other' resources required to utilize it.

-Mike





Want to link to this message? Use this URL: <http://docs.FreeBSD.org/cgi/mid.cgi?kl9ej0$f2b$1>