[Off topic] Difference between wpa: tkip & aes

[Bryan Kadzban]

Jouni Malinen wrote:
> There are no clear differences in TKIP and CCMP frame format that
> would be clearly pointing out which one is being used.

Right -- after encryption, the data is supposed to look pretty much
random to someone that doesn't do any decryption on it.  This makes it
hard to tell what encryption method was used -- I believe that even WEP
looks just about as random as anything else.  (Though maybe that's
changed now.)

> Anyway, the proper verification would be to take a look at what kind
> of WPA/RSN IE was used in (Re)Association Request (and later
> authenticated during 4-Way Handshake).

That's what I've done -- specifically, I look at the part of the WPA/RSN
IE that says which encryption methods are supported and requested (in
all of the (re)association requests, beacons, probe responses, and the
frames in the 4-way handshake), and assume that the client and AP honor
those.

The fields in question contain an OUI and a 1-byte number, where the OUI
is for vendor-specific encryptions, but a standard OUI and byte are
specified for either TKIP or CCMP.  (The IE format, OUI values, and byte
values are part of 802.11i, which is downloadable from IEEE as part of
their "Get 802" thingy.  I'm pretty sure they're in section 7 of the
spec -- but definitely whichever section is named "Frame Formats".)

Ethereal is also helpful decoding these IEs and bytes, if you have a
capture file in a format that it can read.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 256 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20051106/dea86ffe/attachment.pgp