Forum

Hi Reggie:

In 1997 IEEE 802.11 offered one and two megabit data rates with FHSS and DSSS modulation/encoding. (Data throughput was and remains roughly half of data rate for all modulations/encodings.) The standard included WEP based authentication and frame protection using the RC4 encryption algorithm. WEP was intended to be lightweight yet respectable.

By 1999 with the introduction of HR/DSSS and eleven megabit data rates, IEEE WLAN became more appealing. WEP came under scrutiny for the first time by cryptologists who found WEP to be seriously, even embarrassingly, flawed.

Interest in WLAN soared even as respect for WEP soured. By 2001 the IEEE 802.11 committee and 802.11i task group committed to fixing WEP not once but twice! The permanent fix would be based on the new AES encryption algorithm but require a hardware refresh. The temporary fix would be wrapped around WEP, be respectable, and be used as a firmware upgrade to hardware in the field (and in AES based equipment for safely interoperating with firmware patched old hardware). Both would take years to complete and in the meantime was born the bastard faux security technique -- SSID hiding -- which has enchanted and bedeviled the world to this very day.

Work proceeded on both cipher suites in earnest, but it soon became apparent that the temporary cipher suite, TKIP, would be ready in 2003, while the permanent cipher suite, CCMP, would be ready a year later in 2004. It also became apparent that the IEEE 802.11 committee would not ratify one without the other. Sales might suffer unnecessarily in the hiatus between TKIP being ready and being ratified!

Enter the Wi-Fi Alliance (formerly WECA) which had hitherto certified interoperability of their members products based on ratified IEEE 802.11 standards. In 2003 the Alliance certified interoperability of their members products built to the essentially finished but unratified TKIP cipher suite, 802.1X/EAP authentication and key management (AKM), and pre-shared key (PSK) AKM.

The Alliance branded their products "WPA", and artlessly recommended their members' client utilities represent a choice of TKIP and 802.1X as "WPA" and a choice of TKIP and PSK as "WPA PSK".

Many commentators have referred to WPA, both in 2004 and now, as a snapshot or subset of a full IEEE 802.11i solution but do not explain that the full solution is actually two cipher suites, TKIP and CCMP, that share two AKMs, 802.1X/EAP and PSK.

When the IEEE 802.11i amendment was ratified in 2004 the Wi-Fi Alliance created yet another brand, WPA2, and a four way matrix of brands to represent the two cipher suites and two AKMs. WPA2-Enterprise, WPA2-Personal, WPA-Enterprise, and WPA-Personal.

Since all Wi-Fi brands have at least two mutually exclusive meanings, one for the outside of the packaged product describing the sum of all the choices inside the product, and another for the client utility that selects one or two of the choices inside the product, WPA confusion abounds.

I hope this helps. Thanks. /criss