802.11i: five phases, the key hierarchy, and the four-way handshake

First, untangle the names

Six names, one lineage, and the exam will offer you all six as options.

• WEP is the privacy mechanism of the original 802.11 standard. Its privacy portion had major weaknesses; you have just seen one of them.
• The 802.11i task group was formed to replace it.
• WPA was promulgated by the Wi-Fi Alliance to get a fix deployed before 802.11i was finished. It is a set of mechanisms based on the then-current draft — a pre-final subset, not the finished standard. That single fact makes the whole naming mess make sense.
• The final form of 802.11i is called RSN (Robust Security Network).
• WPA2 is the Wi-Fi Alliance's certification for that final standard. Your textbook never uses the name; it is in the callout below with its source.
• WPA3 is the current certification, mandatory for newly certified devices since July 2020.

RSN provides three services: authentication (a protocol between user and authentication server giving mutual authentication and generating temporary keys for the client–AP link), access control (which routes the authentication messages and carries the key exchange, and is deliberately protocol-agnostic), and privacy with message integrity (MAC-level data encrypted together with a message integrity code).

The five phases of operation

1. Discovery. The AP advertises its security policy in Beacon and Probe Response frames. The station picks exactly one AKM suite, one pairwise cipher suite and one group cipher suite, and associates. The protocols for multicast and broadcast traffic are dictated by the AP, because every station in the group must use the same ones.
2. Authentication. The station and the authentication server prove their identities to each other. The AP does not participate in the transaction — it only forwards. It holds the controlled port blocked while the uncontrolled port carries the EAP exchange between supplicant and server.
3. Key management. The AP and the station generate and install cryptographic keys, exchanging frames only between themselves. This is the four-way handshake.
4. Protected data transfer. Frames pass between the station and the far end through the AP, but the protection is station-to-AP only. Security is never end-to-end and never crosses the distribution system; anything end-to-end must come from a higher layer.
5. Connection termination.

The chapter's own review question asks for four phases because termination is trivial. Answer five and name termination last.

The key hierarchy, with the arithmetic

Start at the top. Either a pre-shared key (256 bits) or an AAA key (at least 256 bits, produced by EAP during authentication) becomes the pairwise primary key (PPK), 256 bits. In the pre-shared case, the PSK simply is the PPK; in the enterprise case, the AAA key is truncated into it.

A pseudorandom function built on HMAC-SHA-1 expands the PPK, both MAC addresses and both nonces into the pairwise transient key (PTK): 384 bits for CCMP, 512 bits for TKIP. The PTK is not one key but three concatenated:

• EAPOL key confirmation key (KCK), 128 bits — integrity for the handshake control frames, and access control as a side effect, since producing a valid MIC proves possession of the PPK;
• EAPOL key encryption key (KEK), 128 bits — confidentiality for keys carried inside the handshake;
• temporal key (TK), 128 bits for CCMP or 256 for TKIP — protection for actual user traffic.

And the arithmetic checks both ways: $128+128+128=384$, and $128+128+256=512$. If your slicing does not add up to the standard's stated PTK length, you have the wrong cipher suite in mind.

The group branch is separate: a group primary key expands into the group temporal key (GTK), which protects broadcast and multicast traffic. The PTK is derived from material contributed by both parties; the GTK is generated by the AP alone and pushed out under the KEK, and it is changed whenever a device leaves the network.

The four-way handshake, message by message

Its three purposes: confirm that both sides hold the PPK, verify the cipher-suite selection, and derive a fresh PTK for this session.

• Message 1 — AP to station. The AP's MAC address and its nonce (Anonce). No integrity code yet; there is no key to compute one with.
• Message 2 — station to AP. The station generates its own nonce (Snonce), and now has everything it needs — both nonces, both MAC addresses and the PPK — so it derives the PTK. It returns its address and nonce with a MIC keyed by the KCK. The AP can now derive the same PTK and check that MIC.
• Message 3 — AP to station. The same information again, this time carrying a MIC, and telling the station to install the keys.
• Message 4 — station to AP. An acknowledgement, also MIC-protected.

Why both nonces and both addresses? The addresses bind the key to this specific pair, defending against session hijacking and impersonation; the nonces supply fresh keying material, so neither side can unilaterally fix the resulting key. A separate group key handshake delivers the GTK, protected by the KEK.

Protected data transfer — TKIP versus CCMP

TKIP was designed to be deployable as a software upgrade to hardware already running WEP. Integrity comes from Michael, which computes a 64-bit value from the source and destination MAC addresses, the data and key material. Confidentiality comes from RC4. Its 256-bit TK partitions exactly: 64 bits of Michael key for station-to-AP, 64 bits for AP-to-station, and the remaining 128 bits truncated into the RC4 key. A monotonically increasing TKIP sequence counter blocks replay and is mixed with the temporal key to produce a per-frame encryption key.

CCMP targets newer hardware. Integrity comes from AES CBC-MAC, confidentiality from AES in counter mode, and the same 128-bit AES key serves both. A 48-bit packet number forms the nonce that prevents replay. It requires hardware AES, which is why it could not simply replace WEP everywhere in 2003.