10 Nov 2003 | Print  |

WPA Weakness Discovered, but Easily Solved

by Glenn Fleishman

WPA Weakness Discovered, but Easily Solved -- Following last week's article about the implementation of WPA (Wi-Fi Protected Access) in AirPort Extreme cards and base stations (see "AirPort 3.2 Update Adds New Security Options" in TidBITS-704), a security expert alerted me to a weakness in choosing keys for the WPA system. The weakness applies to the AirPort 3.2 update as well as to all other consumer WPA-enabled Wi-Fi systems. Basically, choosing a key comprised entirely of real words that are 20 characters or fewer leaves you open to that key being broken rather easily. The solution? Choose a longer key or invent 20 characters of gibberish. If you're particularly security-conscious, use the option Apple provides to enter 256 bits of encryption, which is 32 hexadecimal bytes or 64 hexadecimal digits! That's overkill, however. In last week's article, it wasn't clear why Apple even offers the hexadecimal option when other devices from Buffalo and Linksys don't; now it appears that Apple provides all of the options for entering WPA keys, where the other manufacturers don't. I've written more about this issue and posted my colleague's paper on the subject at Wi-Fi Networking News. [GF]

<http://wifinetnews.com/archives/002453.html>

-

Related Articles

• The Wireless Networking Starter Kit, 2nd Edition Released (08 Dec 03)
• AirPort 3.2 Update Adds New Security Options (03 Nov 03)

Top Articles in this Section

• Apple Moves to Unprotected Music, Tiered Prices (06 Jan 09)
• Caffeine Helps Video-Playing Macs Stay Awake (11 Dec 08)
• Apple Lists Top iTunes Downloads of 2008 (03 Dec 08)

WebCrossing Neighbors Creates Private Social Networks
Create a complete social network with your company or group's
own look. Scalable, extensible and extremely customizable.
Take a guided tour today <http://www.webcrossing.com/tour>