WPA with TKIP: No Fast Secure Roaming

WPA with TKIP: No Fast Secure Roaming

By CWNP On 11/01/2010 - 15 Comments

In my previous post , I explained a few details about 802.11 preauthentication. There was a great comment after that blog asking/stating how preauthentication works with WPA. It went like this: “Wouldn’t pre-authentication only be valid for an 802.11i (WPA2) RSN network since the 802.11-2007 standard specifically states the pre-authentication capability is advertised in the RSN IE? This would mean that Wi-Fi Alliance pre-standard WPA would not be able to use this feature since it uses the WPA IE, not the RSN IE.” -- Andrew

He was exactly right, and this point raises such an interesting discussion that I want to expand that first blog by talking specifically about the difference between WPA2 and WPA and how these security types impact fast secure roaming and security features.

First, it is important to know that as long as WEP is not supported and TKIP or CCMP are supported, the BSS is considered to be an RSN. However, the encryption cipher(s) in use also dictates how frames will be formatted in the BSS. Specifically, if the network supports WPA2 (AES-CCMP and optionally, TKIP) security, there will be an RSN information element (IE) in many management frames. If the BSS supports WPA security (TKIP) only, the RSN IE will be replaced with a WPA IE. The purpose of a WPA IE is generally the same as an RSN IE, but a few fields are changed or omitted.

It is the omissions in a WPA IE that are interesting. First, as Andrew pointed out in the comment, the preauthentication field is not present in the WPA IE. Guess what that means? That’s right, no preauthentication support. Bummer. However, it is even more significant that the WPA IE also omits the PMKID Count and List fields as well. These fields are used for almost all other types of modern fast secure roaming, such as PMK caching and Opportunistic Key Caching (OKC). The PMKID Count and List field omission also means that these features are not supported. That’s a big deal for anyone wanting to support WPA-Enterprise in mobile environments.
I took the liberty of capturing a few decoded frames to demonstrate the WPA and RSN IE differences. See the links below, which show the WPA and RSN IEs in their entirety.

http://www.cwnp.com/img/tech/WPA_IE_in_beacon.png http://www.cwnp.com/img/tech/WPA_IE_in_association_request.png http://www.cwnp.com/img/tech/RSN_IE_in_probe_response.png http://www.cwnp.com/img/tech/RSN_IE_in_association_request.png

The first image shows a WPA IE in a beacon (using PSK security), which you can compare with the third image, showing an RSN IE in a probe response (using 802.1X/EAP security). Then compare the second and fourth images, showing a WPA IE in an association request and an RSN IE in an association request. I selectively chose a set of screenshots using PSK and a set using 802.1X/EAP to demonstrate the differences you will see in the real-world.

Notice that the OUI is changed from 00:0F:AC to 00:50:F2 (IEEE to Wi-Fi alliance), but the coding of ciphers and authentication types remain the same. There is no preauthentication bit to set in WPA IEs, and there is no PMKID count or list fields in (re)association frames. You may notice that the RSN IE in the association request frame only contains a PMKID Count field but no PMKID List. That is because the PMKID Count is set to 0. Otherwise, there would be a list of the PMKIDs.

Let me point out that if you need to support TKIP for older clients and you can also support CCMP, you can configure the infrastructure for WPA2, enabling support for both ciphers. This will force the infrastructure to use the RSN IE. Of course, you’ll find that any device requiring TKIP probably does not support fast secure roaming anyway, but there are some clients out there to which this applies.

Let me rant for a second. Roaming support in the enterprise today really just sucks. I don’t understand why this isn’t a bigger deal to vendors (especially client and supplicant vendors). Where does this leave customers wanting to support 802.1X/EAP when mobile applications are used? Up a creek. Aside from proprietary solutions (CCKM or Meru Virtual Port/Cell), nothing works adequately. Since vendors are unwilling to put the best foot forward and support working protocols that solve real problems, customers are left choosing one: security or performance. That’s sad. A sarcastic two thumbs up to you, vendors.

Customers, please let all product manufacturers (infrastructure and client vendors) know how important this feature is to you. Eventually, maybe, the Wi-Fi Alliance will build it into the requirements for WPA2-Enterprise certification. Wouldn’t that be nice.

Tagged with: wi-fi alliance, TKIP, meru, WPA, 802.11r, Voice Enterprise, fast secure roaming, CCKM

15 Responses to WPA with TKIP: No Fast Secure Roaming

Subscribe by Email
Maitri Shah Says:
07/30/2018 at 06:12am
free netflix gift code generator

chu pa Says:
06/29/2018 at 04:05am
Thanks for sharing this helpful guide, I enjoyed your blog
vex 3

Charu Sharma Says:
05/12/2018 at 13:55pm
Ignou Solved Assignment Ignou Solved Assignment of all subject free download for more detail Call/whatsapp on 9560566879.

kris martin Says:
05/07/2018 at 04:40am
Ignou Project Want to say thanks for such a information article

kris martin Says:
05/07/2018 at 04:39am
thanks for letting us know more about wpa, i really love your articles I was going through the same problem since i was working in ignou mba project and looking for help and thats how I came here

zhen12 zhen12 Says:
05/01/2018 at 22:38pm
February 24th, 2004: 1st Round of 1/8 Finals - The Only Handshake
This was the first time that Real Madrid had left Munich as a loser. NFL Jerseys Ma Kai's header made Bayern almost beat Real Madrid again. Unfortunately, Carlos's classic 30-meter free kick reopened Kahn's guarded door when the game left with 7 minutes.NFL Cheap Sports Jerseys Eventually the two sides made a 1:1 handshake. "We were lucky," said Real Madrid's midfielder Zidane, who was at the time. At the time, Bayern coach Hitzfeld said: "We taught Real Madrid how to write the word 'fear'."
March 7, 2007: 1/8 Final Round - Makai Lightning Breaks
This is the first time in Bayern Munich to enter the Allianz Arena in the Champions League "hospitality" Real Madrid - giving opponents the fastest time in the Champions League conceded.Adidas NHL Jersey Thomas Muller later recalled this classic goal from Makai: Adidas NBA Swingman Jersey "Brazo (Salihamidzic) broke the right, passed in, boomed, and scored the ball." The overshoot took 10.12 seconds!Stitched NCAA Hockey Jersey So far this fastest goal record has not been broken. In the second half, CFL Jersey knife guard Lucio used the corner kick to expand the score to 2-0, after which Fannie entered a controversial penalty that made the game tense again. Van Bommel and Diarra had two yellows and one red. Ramos scored a goal in the last minutes of the scent,Flex Base Baseball Jersey but was penalized for handball. In the end, Bayern beat Real Madrid 2-1 (2:3 in the first round) to advance with a goal scoring advantage.April 17,Soccer Club Jersey 2012: The first round of the semi-finals - Gomez continues Bayern's dream
After five years, Real Madrid Bayern met again and the last few minutes of the match were still very exciting.Women Jersey The Champions League final was held at the Allianz Arena with the dream of returning home in the Champions League. Bayern took the lead in the 17th minute and Franck Ribery took the lead to score the second half. Kier helped Real Madrid to equalize, Gomez scored the final seconds of the game so that Allianz Arena 66,000 home fans into madness. Youth Jersey "This is a passionate game. Real Madrid has proved that he is a great team. At the last moment we can win 2-1 with a bit of luck. We can be proud of our victory," Custom Jersey said Rummenigge after the game.April 29, 2014: Semi-final second round - Real Madrid defeats Bayern for the first time0:1 loss to Real Madrid Bayern had a big mountain to cross at home.Nike Pas Cher Outlet "Everything will burn in Munich in Munich" This is a rhetoric released by Rummenigge before the game. However, the results are very different: 20 minutes later, Bayern has fallen behind 0:2, Ramos scored twice. Adidas shoe "We planned a lot but didn't notice the two most standard conditions," said Ram after the game. At the end of halftime, Ronaldo scored another goal and Crome took a second stoppage. Real Madrid expanded the winning streak and defeated the ten rivals of the Madrid City AFC Champions League in the final.April 12,Nike Air Force One 2017: First round of the quarter-finals - reversal of Real Madrid Allianz Arena
The two sides played against each other at the Allianz Arena and Real Madrid brought misfortune to Bayern.Nike Air Huarache However, Bayern's start is quite good: In the 25th minute, Bidar headed for Bayern to lead.Nike Air Jordan At the end of the half he was even expected to change the score to 2:0, but he missed the penalty. Bayern wasted the opportunity to pay the price of bearing.Nike Air Max Cristiano Ronaldo reached the score in the second half of the opening match. In the 61st minute, Martinez was sent off. In 77 minutes, NMD R1 shoe Crome opened twice and Real Madrid reversed Bayern. After Ram’s conclusion: “The match turned sharply after being equalized. Both yellow and red are the turning points of the game.”

wiatmppgryar wiatmppgryar Says:
04/18/2018 at 03:23am
Varan 25+9 Drummond truce Raptors far from the particular Pistons

Raptors 108-98 benefits Brent Celek Jerseys the particular Pistons, Raptors Brian Dawkins Jerseys four-game profitable skills, Vallanchunas twenty-five items and also 9 rebounds, DeRozan of sixteen items and also 7 Bennie Logan Jerseys facilitates, Boulter 12 items and also 7 rebounds, Lori 11 items and also 9 facilitates, Brian Westbrook Jerseys Loren Zoe-Brown together with 11 items and also Siakam together with 10 items; Pistons two-game shedding skills, Brandon Brooks Jerseys Drummond absent regarding injuries together with Calf msucles, Kennard together with 20 items, Reggie Knutson together with of sixteen items and also 9 facilitates, and also Iss Jones together with 15 items. Tolliver have scored 13 items, Ellenson have scored 12 items, and also Moreland have scored 11 items.

Inside the initial 1 / 4 with the beginning video game, inside the 15th next, Drozan dispatched a perfect complete, and also Sikham struck any three-pointer. Inside the 6 and also 24th just a few seconds, DeRozan slapped and also misplaced the particular basketball, and also Morland have scored any take. Inside 11 moments and also forty-five just a few seconds, Allenson fouled DeRozan and also provided Allen Barbre Jerseys the particular Raptors a couple of totally free chuck tries. The particular Philadelphia Eagles Pistons enjoyed clean coordination. On this part, the particular staff accomplished 10 facilitates. One of them, Yis Jones dispatched 3 moves regarding his / her teammates. The particular Pistons sense really excellent on this part. The particular team's firing proportion attained 58. 87%, which can be better yet Carson Wentz Jerseys compared to the Raptors' 57. 89%. Kennard have scored simply 10 items on this part. Inside the initial 1 / 4, the 2 factors fought as well as the report has been 32-32. Inside the next 1 / 4, thirty three just a few seconds afterwards, Ennis overlooked the particular complete and also has been intercepted simply by White-colored. Inside the next second and also twenty four just a few seconds, Powell fouled Allenson's photo and also provided the particular Pistons a couple of totally free chuck tries. 8 moments 10 just a few seconds, acquired Reggie : Jackson's complete, Kennedy three-thirds extended photo prevailed. The particular Raptors have scored a few items inside the bad weather. The particular staff have scored 18 three-pointers this kind of 1 / 4, nevertheless the firing fee has been simply 7. 14%. By the end regarding halftime, the particular Pistons simply came into another part using a three-point direct.

Ex lover situ struggles, 1 second 20 just a few seconds, Sikham photo nasty any time Kennard photo, offering the particular Pistons a couple of totally free punches. Inside the next second and also more effective just a few seconds, Annuo misplaced his / her palm and also misplaced the particular basketball, Alshon Jeffery Jerseys and also has been NFL Jerseys obtained Caleb Sturgis Jerseys simply by Morand. Inside Philadelphia Eagles Jerseys the particular 6th second and also forty four just a few seconds, getting a complete coming from DeRozan, Lori have scored any three-point extended photo. The particular Raptors enjoyed easily as well as the staff accomplished 8 facilitates altogether. One of them, DeRozan dispatched 3 moves regarding his / her teammates. Brandon Graham Jerseys The particular Raptors have scored a few items inside the bad weather as well as the staff have scored 10 three-pointers on this part, firing 45. 00%. The particular Pistons bombarded the particular holder repeatedly and also acquired 11 totally free chuck tries, any charges regarding 8 targets, plus a totally free chuck proportion regarding 72. 73%. Following your next 1 / 4, the particular Raptors travelled entirely to be able to 85-80. Inside the next 1 / 4, 3 moments and also 45 just a few seconds, White-colored fouled Morland in the photo and also provided the particular Pistons a couple of totally free chuck tries. With 3 moments and also 53 just a few seconds, Powell produced any transferring blunder and also has been seized simply by Ennis. 7 moments and also 18 just a few seconds, acquired Reggie : Jackson's complete, Toliff have scored any three-pointer. The particular Pistons have scored a few items in the line, as well as the staff have scored 10 three-pointers this kind of 1 / 4, nevertheless the proportion has been simply 20. 00%. By the end with the video game, the particular Raptors conquer the particular Pistons 108-98 to be able to acquire the sport.

wiatmppgryar wiatmppgryar Says:
04/18/2018 at 03:22am
Varan 25+9 Drummond truce Raptors clear of this Pistons

Raptors 108-98 victories Brent Celek Jerseys this Pistons, Raptors Brian Dawkins Jerseys four-game receiving streak, Vallanchunas 20 details in addition to 9 rebounds, DeRozan 04 details in addition to 7 Bennie Logan Jerseys allows, Boulter 12 details in addition to 7 rebounds, Lori 11 details in addition to 9 allows, Brian Westbrook Jerseys Loren Zoe-Brown having 11 details in addition to Siakam having 10 details; Pistons two-game burning off streak, Brandon Brooks Jerseys Drummond missing out on intended for personal injury having Posterior muscle group, Kennard having 20 details, Reggie Fitzgibbons having 04 details in addition to 9 allows, in addition to Iss Henderson having 15 details. Tolliver scored 13 details, Ellenson scored 12 details, in addition to Moreland scored 11 details.

From the primary 1 fourth on the launching activity, from the 15th minute, Drozan directed superb cross, in addition to Sikham attack some sort of three-pointer. From the sixth in addition to 24th moments, DeRozan slapped in addition to shed this baseball, in addition to Morland scored some sort of gain access to. With 11 a few minutes in addition to 1 out of 3 moments, Allenson fouled DeRozan in addition to afforded Allen Barbre Jerseys this Raptors a couple cost-free place endeavors. This Philadelphia Eagles Pistons competed even coordination. In this particular portion, this workforce done 10 allows. And this includes, Yis Henderson directed 3 travels intended for his or her teammates. This Pistons think rather beneficial in this particular portion. This team's filming fraction gotten to 59. 87%, that's more desirable Carson Wentz Jerseys versus Raptors' 57. 89%. Kennard scored solely 10 details in this particular portion. From the primary 1 fourth, each features not been as successful along with the ranking seemed to be 32-32. From the minute 1 fourth, thirty-three moments in the future, Ennis had missed this cross in addition to seemed to be intercepted by means of Light. From the final small in addition to per day moments, Powell fouled Allenson's opportunity in addition to afforded this Pistons a couple cost-free place endeavors. 8 a few minutes 10 moments, been given Reggie -- Jackson's cross, Kennedy three-thirds very long opportunity succeeded. This Raptors scored several details from the water. This workforce scored age 14 three-pointers that 1 fourth, even so the filming pace seemed to be solely 7. 14%. Right at the end connected with halftime, this Pistons solely inserted your next portion that has a three-point cause.

Ex-mate situ challenges, 1 small 21 moments, Sikham opportunity potent as soon as Kennard opportunity, presenting this Pistons 3 cost-free kicks. From the finally small in addition to several moments, Annuo shed his or her give in addition to shed this baseball, Alshon Jeffery Jerseys in addition to seemed to be NFL Jerseys considered Caleb Sturgis Jerseys by means of Morand. With Philadelphia Eagles Jerseys this 5th small in addition to 44 moments, finding a cross by DeRozan, Lori scored some sort of three-point very long opportunity. This Raptors competed without problems along with the workforce done 8 allows in one payemnt. And this includes, DeRozan directed 3 travels intended for his or her teammates. Brandon Graham Jerseys This Raptors scored several details from the water along with the workforce scored 10 three-pointers in this particular portion, filming 50. 00%. This Pistons infected this baskets once or twice in addition to been given 11 cost-free place endeavors, some sort of punishment connected with 8 aims, as well as a cost-free place fraction connected with 72. 73%. As soon as the finally 1 fourth, this Raptors journeyed right to help 85-80. From the final 1 fourth, 3 a few minutes in addition to 50 moments, Light fouled Morland within a opportunity in addition to afforded this Pistons a couple cost-free place endeavors. On 3 a few minutes in addition to 53 moments, Powell manufactured some sort of driving miscalculation in addition to seemed to be grabbed by means of Ennis. 7 a few minutes in addition to age 14 moments, been given Reggie -- Jackson's cross, Toliff scored some sort of three-pointer. This Pistons scored several details within a row, along with the workforce scored 10 three-pointers that 1 fourth, even so the fraction seemed to be solely 20. 00%. Right at the end on the activity, this Raptors overcome this Pistons 108-98 to help gain the experience.

crothermbeme crothermbeme Says:
04/18/2018 at 02:51am
On Monday,NFL jersesys shop US local time, the New England Patriots began their first voluntary activity in the offseason. Many media have focused their attention on the absence of quarterbackShop NFL Jerseys By Team Tom Brady and near-fielder Rob Gronkowski. However, the return of a key player deserves the same level of attention. He is the wide receiver - JulianBuy Customized NFL Jerseys Edelman. On Monday, Edelman appeared in the Gillette Stadium. This was his first step toward a $500,000 training bonus.Shop NFL Hats
The amount Shop NFL T-Shirtsof this bonus ranks first in the Patriot team. The following is the comparison of Edelman's total training bonus with other players in the team: Edelman:Shop NFL Hoodie $500,000 in Glonnowski: $250,000 Kickback Goalbacker Kodarel Patterson: $250,000 in defense Endpoints Lawrence Guy: $200,000 kicker Stephen Gestkowski: $100,000Pittsburgh Steelers Jerseys security guard Patrick Bell (Clock family): $85,000 In addition to the bonus, Edelman's appearance is also A positive signal was Minnesota Vikings Jerseysreleased: He was recovering systematically from the anterior cruciate ligament tear injury on August 25 last year. With Brandine Cooks Customized Seattle Seahawks Jerseysbeing traded by the team, Danny Amundola joined the Miami Dolphins again through the free agency market. As Brady’s numberCustomized Carolina Panthers Jerseys one goal, Edelman’s return to health in the new season is The Patriots' top priority. As a rule, Brady and Edelman hadIndianapolis Colts Hats practiced many passes during this offseason.
In addition, Edelman’s move Tampa Bay Buccaneersto Gillette Stadium on Monday was also a balance between strength training and Brady’s personal trainer Alex Guerrero. Edelman, who willSeattle Seahawks Hoodie soon turn 32, is a frequent guest of the TB12 Sports Therapy Center founded by Guerrero.
It is reported that Brady may reduceLos Angeles Chargers Hoodie the frequency of participating in the Patriots training during this offseason, and will pay more attention to his training withBaltimore Ravens T-shirts Guerrero. From the current situation, Edelman does not seem to have similar ideas with Brady. (TB12 is Tom Brady's English initialsAtlanta Falcons T-shirts and jersey number.) If you don't remember what Elderman's Patriots lost last season, perhaps the following three facts can remind Denver Broncos T-shirtsyou of Edelman’s Importance: 1. He collected data in 89 postseason games, ranking third in NFL history, second only to Jerry Rice's 151Jacksonville Jaguars Hoodie and Reggie Wayne's 93.
This also means that as long as Edelman completed Los Angeles Rams Hatsfive postseason catches, he will surpass Wayne and rank second in history. 2. He was one of 14 players who completed at least 1000 yardsCustomized New England Patriots Jerseys of NFL postseason advancement and ranked 13th in NFL history with 1024 yards of data. As long as Edelman finished San Francisco 49ers Jerseyscatching the ball in the 39-yard playoffs, he will be ranked in the top ten in history. 3. In his career, a total of four postseasonArizona Cardinals Jerseys games have completed single-field catches and advanced over 100 yards. In this data, he and Dion - Blanche together, ranked first in the history of the Patriots.

Caroline Flack Says:
02/07/2018 at 07:38am
The WPA really has nothing to do with your console other than it needs the rule to gain accessibility your wireless router and in turn your Internet according to the Dissertation Writing Service UK . If you did not set your wireless router up or you have no idea who knows the rule then hopefully no one modified this

Sara Marchetti Says:
01/19/2018 at 03:26am
Thanks for the best blog was very useful for me. Keep sharing such ideas in the future as well.
Thanks for giving me the useful information.

Kr Ashwin Says:
12/08/2017 at 04:19am
Just click on this fireboy and watergirl games and play amazing Mind twister video games for free of cost and online.You love to play like me and share to the others.Thank you so much to this game Junction.

11/16/2010 at 11:57am
TKIP will drop from the Wi-Fi certification in 2012. I know it isn't quite soon enough but that should help drive performance. So, maybe in the 2017 timeframe we can turn off TKIP once and for all. Incidentally, WEP doesn't drop off till 2013.

11/01/2010 at 11:50am
Dude, killer post! All I can say is AMEN BROTHER. I wish I had some clever comment to add, but this is a stellar post...and I got nuthin' (to add). You're spot-on about the industry's need for Voice-Enterprise certification, and it doesn't look like the Voice-Ent TG at the WFA is moving very quickly (due to a lack of vendor support on both sides of the table unfortunately). It's chicken/egg I think. Infrastructure vendors won't jump in because the client-side vendors won't...and vice-versa. :( Just my opinion. Plug-fests keep getting delayed or canceled. OKC isn't widely supported in the client side, so the industry really needs to step up to Voice-Enterprise in a hurry. Again, nice post!

11/01/2010 at 11:43am
Great follow-up post Marcus! Everyone needs to scream at the top of their lungs at infrastructure and client manufacturers to implement fast roaming support (802.11r specifically) into their products.

<< prev - comments page 1 of 1 - next >>

Leave a Reply

Please login or sign-up to add your comment.
Success Stories

I literally just came out of the testing centre having taken the CWDP exam. The certification process opened my mind to different techniques and solutions. This knowledge can only broaden your perspective. Great job, CWNP, you have a great thing going on here.

Read More

Working through the CWNP coursework and certifications helped not only to deepen my technical knowledge and understanding, but also it boosted my confidence. The hard work it took to earn my CWNE has been rewarding in so many ways.

Read More

I want to commend you and all at CWNP for having a great organization. You really 'raise the bar' on knowing Wi-Fi well. I have learned a ton of information that is helping my job experience and personal career goals, because of my CWAP/CWDP/CWSP studies. Kudos to all at CWNP.

Read More