2020-07-01

WPA3-Personal PSK passphrase mismatch

WPA3-Personal PSKパスフレーズを間違えて入力した場合のログを見てみましょう。
Auth Commit、Auth Confirm まで確認できますが、Assoc Request/Response および 4-way handshake を実施していないことが分かります。

AP505# show ap debug auth-trace-buf

Auth Trace Buffer
-----------------

<none>

AP505# show ap debug mgmt-frames

Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jul  1 11:21:08.144  auth        b8:3a:5a:8b:36:d0  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  15      SAE-Confirm:0
Jul  1 11:21:08.143  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  b8:3a:5a:8b:36:d0  0       SAE-Confirm:0
Jul  1 11:21:08.116  auth        b8:3a:5a:8b:36:d0  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  15      SAE-Commit:0
Jul  1 11:21:08.080  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  b8:3a:5a:8b:36:d0  0       SAE-Commit:0

また、show log security コマンドにて、Auth Confirm でエラーが発生しているログが確認できます。

AP505# show log security

Jul  1 11:21:08  wpa3_sae[5462]: <135917> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_confirm,(1601) station= 84:ab:1a:11:d2:f6  Error while process peer's confirm. Reason: Confirm did not verify
Jul  1 11:21:08  wpa3_sae[5462]: <135906> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_authentication_frame, station= 84:ab:1a:11:d2:f6 State machine failed in process confirm
Jul  1 11:21:08  wpa3_sae[5462]: <135919> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_mgmt_frame,(232) station= 84:ab:1a:11:d2:f6  Error: Fatal error while processing auth frame
Jul  1 11:21:08  wpa3_sae[5462]: <135014> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_sae_event(294)(thread-id: 0): Received fatal error for station= 84:ab:1a:11:d2:f6 while Processing sae event

[English Version]
Let's see when WPA3-Personal PSK passphrase mismatch happens.
We can see Auth Commit and Auth Confirm, but we can not see Assoc Request/Response and 4-way handshake.

AP505# show ap debug auth-trace-buf

Auth Trace Buffer
-----------------

<none>

AP505# show ap debug mgmt-frames

Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jul  1 11:21:08.144  auth        b8:3a:5a:8b:36:d0  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  15      SAE-Confirm:0
Jul  1 11:21:08.143  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  b8:3a:5a:8b:36:d0  0       SAE-Confirm:0
Jul  1 11:21:08.116  auth        b8:3a:5a:8b:36:d0  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  15      SAE-Commit:0
Jul  1 11:21:08.080  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d0  b8:3a:5a:8b:36:d0  0       SAE-Commit:0

From show log security, we can see Auth Confirm error.

AP505# show log security

Jul  1 11:21:08  wpa3_sae[5462]: <135917> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_confirm,(1601) station= 84:ab:1a:11:d2:f6  Error while process peer's confirm. Reason: Confirm did not verify
Jul  1 11:21:08  wpa3_sae[5462]: <135906> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_authentication_frame, station= 84:ab:1a:11:d2:f6 State machine failed in process confirm
Jul  1 11:21:08  wpa3_sae[5462]: <135919> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_mgmt_frame,(232) station= 84:ab:1a:11:d2:f6  Error: Fatal error while processing auth frame
Jul  1 11:21:08  wpa3_sae[5462]: <135014> <ERRS> |AP AP505@192.168.210.215 wpa3_sae|  process_sae_event(294)(thread-id: 0): Received fatal error for station= 84:ab:1a:11:d2:f6 while Processing sae event

2020-06-30

Connecting Apple iPhone SE/iPad Air2 to Aruba AP-505 WPA3-Personal

WPA3 対応の iPhone SE/iOS13.5.1 と WPA2 対応の iPad Air2/iOS13.5.1 をアルバ AP-505/Instant OS 8.7.0.0/WPA3-Personal に接続してみました。アルバでは、opmode-transition コマンドがデフォルトで有効で、WPA3 端末だけではなく、WPA2 端末も同一の SSID で接続させることが可能なため、比較するのに便利です。

WPA3 対応の iPhone SE (MAC address = 84:ab:1a:11:d2:f6) 接続時

Auth Commit、Auth Confirm、Assocの後に、4-way handshakeを実施しているのが分かる。

AP505# show ap debug auth-trace-buf


Auth Trace Buffer
-----------------
Jun 30 15:21:31  sae-pmk-update         *  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  -    Grp:19 PMK:32 Succ
Jun 30 15:21:31  station-up             *  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  -    wpa3-sae aes-ccmp-128
Jun 30 15:21:31  wpa2-key1             <-  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:21:31  wpa2-key2             ->  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  135  
Jun 30 15:21:31  wpa2-key3             <-  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  191  
Jun 30 15:21:31  wpa2-key4             ->  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  95   


AP505# show ap debug mgmt-frames


Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jun 30 15:21:31.497  assoc-resp  b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      Success
Jun 30 15:21:31.497  assoc-req   84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  43      -
Jun 30 15:21:31.494  auth        b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      SAE-Confirm:0
Jun 30 15:21:31.493  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       SAE-Confirm:0
Jun 30 15:21:31.466  auth        b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      SAE-Commit:0
Jun 30 15:21:31.430  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       SAE-Commit:0

WPA2 対応の iPad Air2 (MAC address = 04:69:f8:0c:88:a6) 接続時

Auth、Assoc、4-way handshakeを実施しているのが分かる。

AP505# show ap debug auth-trace-buf


Auth Trace Buffer
-----------------
Jun 30 15:22:05  station-up             *  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  -    wpa2 psk aes
Jun 30 15:22:05  wpa2-key1             <-  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:22:05  wpa2-key2             ->  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:22:05  wpa2-key3             <-  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  191  
Jun 30 15:22:05  wpa2-key4             ->  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  95  
 
AP505# show ap debug mgmt-frames


Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jun 30 15:22:05.310  assoc-resp  b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  15      Success
Jun 30 15:22:05.310  assoc-req   04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  45      -
Jun 30 15:22:05.308  auth        b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  15      Success (seq num 0)
Jun 30 15:22:05.308  auth        04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       -

Association 情報

iPhone SEは、S: SAE client フラグがついており、WPA3 SAEに対応していることが分かる。また、phy が a-HE-20-2ss となっており、11ax/HE (High Efficiency) に対応していることが分かる。

AP505# show ap association


The phy column shows client's operational capabilities for current association

Flags: H: Hotspot(802.11u) client, K: 802.11K client, M: VHT Mu beam formee, R: 802.11R client, W: WMM client, w: 802.11w client, V: 802.11v BSS trans capable, P: Punctured preamble, U: HE UL Mu-mimo, O: OWE client, S: SAE client, E: Enterprise client, m: Agile Multiband client, C: Cellular Data Capable - network available, c: Cellular Data Capable - network unavailable, T: Individual TWT client, t: Broadcast TWT client

PHY Details: HT   : High throughput;      20: 20MHz;  40: 40MHz; t: turbo-rates (256-QAM)
             VHT  : Very High throughput; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
             HE   : High Efficiency;       80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
             <n>ss: <n> spatial streams

Association Table
-----------------
Name   bssid              mac                auth  assoc  aid  l-int  essid                     vlan-id  phy              assoc. time  num assoc  Flags  DataReady       UAC      
----   -----              ---                ----  -----  ---  -----  -----                     -------  ---              -----------  ---------  -----  ---------       ---      
AP505  b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  y     y      1    20     bin4-wpa3-personal-trans  1        a-HE-20-2ss      2m:40s       1          WVwS   Yes (Implicit)  0.0.0.0  
AP505  b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  y     y      2    20     bin4-wpa3-personal-trans  1        a-VHT-20sgi-2ss  2m:6s        1          WVw    Yes (Implicit)  0.0.0.0  
Num Clients:2

Client-table 情報

e - Beamformer フラグがついているが、こちらからは特に違いがなかった。

AP505# show ap debug client-table


Client Table
------------
MAC                ESSID                     BSSID              Assoc_State  HT_State  AID  PS_State    UAPSD            TWT    Tx_Pkts  Rx_Pkts  PS_Qlen  Tx_Retries  Tx_Rate  Rx_Rate  Last_ACK_SNR  Last_Rx_SNR  TX_Chains  Tx_Timestamp              Rx_Timestamp              MFP Status (C,R)  Idle time  Client health (C/R)  Tx_Bytes  Rx_Bytes
---                -----                     -----              -----------  --------  ---  --------    -----            ---    -------  -------  -------  ----------  -------  -------  ------------  -----------  ---------  ------------              ------------              ----------------  ---------  -------------------  --------  --------
04:69:f8:0c:88:a6  bin4-wpa3-personal-trans  b8:3a:5a:8b:36:d1  Associated   AWvSsEe   0x2  Power-save  (0,0,0,0,N/A,0)  (0,0)  62       516      0        0           156      173      65            62           2[0x3]     Tue Jun 30 15:24:10 2020  Tue Jun 30 15:24:11 2020  (1,1)             0          100/8                23367     29882
84:ab:1a:11:d2:f6  bin4-wpa3-personal-trans  b8:3a:5a:8b:36:d1  Associated   AWvSsE    0x1  Power-save  (0,0,0,0,N/A,0)  (0,0)  96       608      0        1           258      286      58            60           2[0x3]     Tue Jun 30 15:24:02 2020  Tue Jun 30 15:24:05 2020  (1,1)             6          100/8                34142     15469
                                                                                                                                                                                                                                                                                                                                               
Num of associated clients: 2
UAPSD:(VO,VI,BK,BE,Max SP,Q Len)
TWT:(iTWT sessions num, bTWT groups num)
HT  Flags: A - LDPC Coding; B - TX STBC; D - Delayed BA; G - Greenfield
           I - HT40 Intolerant; M - Max A-MSDU; N - A-MPDU disabled
           Q - Static SM PS; R - Dynamic SM PS; S - Short GI 40; W - 40 MHz
           b - RX STBC; s - Short GI 20; t - turbo-rates (256-QAM)
VHT Flags: C - 160MHz/80+80MHz; E - Beamformee;  V - Short GI 160
           c - 80MHz; e - Beamformer; v - Short GI 80
HT_State shows client's original capabilities (not operational capabilities)
MFP Status: C - 1 if the station is MFP capable; R - 1 if the station has negotiated MFP

WPA3 対応の iPhone SE 接続時の無線キャプチャ

f:id:bin4:20200630221249p:plain
f:id:bin4:20200701144137p:plain

WPA3 対応の iPad Air2 接続時の無線キャプチャ

f:id:bin4:20200630221350p:plain
f:id:bin4:20200701144152p:plain

[English Version]

I got iPhone SE/iOS13.5.1 which supports WPA3 and iPad Air2/iOS13.5.1 which supports WPA2. So I tried to connect to Aruba AP505/Instant OS 8.7.0.0 WPA3-Personal. opmode-transition command is enabled by default, then not only WPA3 clients but also WPA2 clients can associate the SSID.

Connecting iPhone SE (MAC address = 84:ab:1a:11:d2:f6)

We can see Auth Commit/Auth Confirm/Assoc and 4-way handshake.

AP505# show ap debug auth-trace-buf


Auth Trace Buffer
-----------------
Jun 30 15:21:31  sae-pmk-update         *  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  -    Grp:19 PMK:32 Succ
Jun 30 15:21:31  station-up             *  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  -    wpa3-sae aes-ccmp-128
Jun 30 15:21:31  wpa2-key1             <-  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:21:31  wpa2-key2             ->  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  135  
Jun 30 15:21:31  wpa2-key3             <-  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  191  
Jun 30 15:21:31  wpa2-key4             ->  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  -  95   


AP505# show ap debug mgmt-frames


Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jun 30 15:21:31.497  assoc-resp  b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      Success
Jun 30 15:21:31.497  assoc-req   84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  43      -
Jun 30 15:21:31.494  auth        b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      SAE-Confirm:0
Jun 30 15:21:31.493  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       SAE-Confirm:0
Jun 30 15:21:31.466  auth        b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  15      SAE-Commit:0
Jun 30 15:21:31.430  auth        84:ab:1a:11:d2:f6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       SAE-Commit:0

Connecting iPad Air2 (MAC address = 04:69:f8:0c:88:a6)

We can see Auth/Assoc, and 4-way handshake.

AP505# show ap debug auth-trace-buf


Auth Trace Buffer
-----------------
Jun 30 15:22:05  station-up             *  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  -    wpa2 psk aes
Jun 30 15:22:05  wpa2-key1             <-  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:22:05  wpa2-key2             ->  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  117  
Jun 30 15:22:05  wpa2-key3             <-  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  191  
Jun 30 15:22:05  wpa2-key4             ->  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  -  95  
 
AP505# show ap debug mgmt-frames


Traced 802.11 Management Frames
-------------------------------
Timestamp            stype       SA                 DA                 BSS                signal  Misc
---------            -----       --                 --                 ---                ------  ----
Jun 30 15:22:05.310  assoc-resp  b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  15      Success
Jun 30 15:22:05.310  assoc-req   04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  45      -
Jun 30 15:22:05.308  auth        b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  15      Success (seq num 0)
Jun 30 15:22:05.308  auth        04:69:f8:0c:88:a6  b8:3a:5a:8b:36:d1  b8:3a:5a:8b:36:d1  0       -

Association information

We can see S: SAE client flag on iPhone SE, this shows iPhone SE support WPA3 SAE. And we can also see phy a-HE-20-2ss, this shows iPhose SE support 11ax/HE (High Efficiency).

AP505# show ap association


The phy column shows client's operational capabilities for current association

Flags: H: Hotspot(802.11u) client, K: 802.11K client, M: VHT Mu beam formee, R: 802.11R client, W: WMM client, w: 802.11w client, V: 802.11v BSS trans capable, P: Punctured preamble, U: HE UL Mu-mimo, O: OWE client, S: SAE client, E: Enterprise client, m: Agile Multiband client, C: Cellular Data Capable - network available, c: Cellular Data Capable - network unavailable, T: Individual TWT client, t: Broadcast TWT client

PHY Details: HT   : High throughput;      20: 20MHz;  40: 40MHz; t: turbo-rates (256-QAM)
             VHT  : Very High throughput; 80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
             HE   : High Efficiency;       80: 80MHz; 160: 160MHz; 80p80: 80MHz + 80MHz
             <n>ss: <n> spatial streams

Association Table
-----------------
Name   bssid              mac                auth  assoc  aid  l-int  essid                     vlan-id  phy              assoc. time  num assoc  Flags  DataReady       UAC      
----   -----              ---                ----  -----  ---  -----  -----                     -------  ---              -----------  ---------  -----  ---------       ---      
AP505  b8:3a:5a:8b:36:d1  84:ab:1a:11:d2:f6  y     y      1    20     bin4-wpa3-personal-trans  1        a-HE-20-2ss      2m:40s       1          WVwS   Yes (Implicit)  0.0.0.0  
AP505  b8:3a:5a:8b:36:d1  04:69:f8:0c:88:a6  y     y      2    20     bin4-wpa3-personal-trans  1        a-VHT-20sgi-2ss  2m:6s        1          WVw    Yes (Implicit)  0.0.0.0  
Num Clients:2

Client-table information

The difference between iPhone SE and iPad is e - Beamformer flag on iPhone SE, but we can not recognize WPA3 enabled or not.

AP505# show ap debug client-table


Client Table
------------
MAC                ESSID                     BSSID              Assoc_State  HT_State  AID  PS_State    UAPSD            TWT    Tx_Pkts  Rx_Pkts  PS_Qlen  Tx_Retries  Tx_Rate  Rx_Rate  Last_ACK_SNR  Last_Rx_SNR  TX_Chains  Tx_Timestamp              Rx_Timestamp              MFP Status (C,R)  Idle time  Client health (C/R)  Tx_Bytes  Rx_Bytes
---                -----                     -----              -----------  --------  ---  --------    -----            ---    -------  -------  -------  ----------  -------  -------  ------------  -----------  ---------  ------------              ------------              ----------------  ---------  -------------------  --------  --------
04:69:f8:0c:88:a6  bin4-wpa3-personal-trans  b8:3a:5a:8b:36:d1  Associated   AWvSsEe   0x2  Power-save  (0,0,0,0,N/A,0)  (0,0)  62       516      0        0           156      173      65            62           2[0x3]     Tue Jun 30 15:24:10 2020  Tue Jun 30 15:24:11 2020  (1,1)             0          100/8                23367     29882
84:ab:1a:11:d2:f6  bin4-wpa3-personal-trans  b8:3a:5a:8b:36:d1  Associated   AWvSsE    0x1  Power-save  (0,0,0,0,N/A,0)  (0,0)  96       608      0        1           258      286      58            60           2[0x3]     Tue Jun 30 15:24:02 2020  Tue Jun 30 15:24:05 2020  (1,1)             6          100/8                34142     15469
                                                                                                                                                                                                                                                                                                                                               
Num of associated clients: 2
UAPSD:(VO,VI,BK,BE,Max SP,Q Len)
TWT:(iTWT sessions num, bTWT groups num)
HT  Flags: A - LDPC Coding; B - TX STBC; D - Delayed BA; G - Greenfield
           I - HT40 Intolerant; M - Max A-MSDU; N - A-MPDU disabled
           Q - Static SM PS; R - Dynamic SM PS; S - Short GI 40; W - 40 MHz
           b - RX STBC; s - Short GI 20; t - turbo-rates (256-QAM)
VHT Flags: C - 160MHz/80+80MHz; E - Beamformee;  V - Short GI 160
           c - 80MHz; e - Beamformer; v - Short GI 80
HT_State shows client's original capabilities (not operational capabilities)
MFP Status: C - 1 if the station is MFP capable; R - 1 if the station has negotiated MFP

air capture on connecting iPhone SE

f:id:bin4:20200630221249p:plain
f:id:bin4:20200701144137p:plain

air capture on connecting iPad Air2

f:id:bin4:20200630221350p:plain
f:id:bin4:20200701144152p:plain

2020-05-08

WPA3-Personal Configuration for AP-505/Instant OS 8.6.0.4

AP505# show running-config

<snip>

wlan access-rule bin4-wpa3-personal-sae
index 2
rule any any match any any any permit

wlan access-rule bin4-wpa3-personal-trans
index 3
rule any any match any any any permit

wlan ssid-profile bin4-wpa3-personal-sae
enable
index 0
type employee
essid bin4-wpa3-personal-sae
wpa-passphrase 8fa44784537f579db0307212144237fd3c045b969fe58212
opmode wpa3-sae-aes
opmode-transition-disable
max-authentication-failures 0
rf-band all
captive-portal disable
dtim-period 1
broadcast-filter arp
dmo-channel-utilization-threshold 90
local-probe-req-thresh 0
max-clients-threshold 64

wlan ssid-profile bin4-wpa3-personal-trans
enable
index 1
type employee
essid bin4-wpa3-personal-trans
wpa-passphrase 315284befe139583a6bb0f3278ff99c448d2c969e1910744
opmode wpa3-sae-aes
max-authentication-failures 0
rf-band all
captive-portal disable
dtim-period 1
broadcast-filter arp
dmo-channel-utilization-threshold 90
local-probe-req-thresh 0
max-clients-threshold 64

f:id:bin4:20200508091327p:plain

I could not find opmode-transition option in GUI.

2020-05-07

WPA3-Personal Beacon

WPA3-Personal の Beacon フレームをキャプチャしてみました。使用した機器は、アルバの AP-505/Instant OS 8.6.0.4 です。また、アルバには、opmode-transition コマンドがデフォルトで有効で、WPA3 端末だけではなく、WPA2 端末も同一の SSID で接続させることが可能です。今回は、opmode-transitionが有効 (default) なSSID「bin4-wpa3-personal-trans」とopmode-transitionが無効なSSID「bin4-wpa3-personal-sae」を設定し、比較してみました。

show ap bss-table コマンド

f:id:bin4:20200507183333p:plain

flags 列で各種オプションを確認することができます。opmode-transitionが有効なSSIDには、M フラグ (WPA3-SAE mixed mode BSS) が付いていることが確認できます。

bin4-wpa3-personal-trans (opmode-transitionが有効) の Beacon フレーム

f:id:bin4:20200507190545p:plain

RSN Information タグの AKM (Auth Key Management) に 00:0f:ac:2 (PSK) と00:0f:ac:8 (SAE) の2つあることが確認できます。また、RSN Capabilities 内の 802.11w/PMF (Protected Management Frames) が PMFR=0、PMFC=1 となっていることが確認できます。これにより、WPA3 端末だけではなくWPA2 端末も接続させることが可能です。

bin4-wpa3-personal-sae (opmode-transitionが無効) の Beacon フレーム

f:id:bin4:20200507185751p:plain

opmode-transitionが無効なSSIDでは、RSN Information タグの AKM に 00:0f:ac:8 (SAE) のみ、RSN Capabilities 内の 802.11w/PMF が PMFR=1、PMFC=1 となっていることが確認できます。WPA3-Personal では 802.11w が必須であり、Beacon フレームからも確認できます。

[English Version]

I captured WPA3-Personal Beacon frames using Aruba AP505/Instant OS 8.6.0.4. opmode-transition command is enabled by default, then not only WPA3 clients but also WPA2 clients can associate the SSID. So, I set opmode-transition enabled SSID: bin4-wpa3-personal-trans and disabled SSID: bin4-wpa3-personal-sae.

output of show ap bss-table

f:id:bin4:20200507183333p:plain

We can see each WPA3 flags in flags column. For opmode-transition enabled SSID, there is M flag which means "WPA3-SAE mixed mode BSS".

bin4-wpa3-personal-trans (opmode-transition enabled) Beacon frame

f:id:bin4:20200507190545p:plain

In RSN Information Tag, there are AKM (Auth Key Management) 00:0f:ac:2 (PSK) and 00:0f:ac:8 (SAE). In RSN Capabilities, we can see PMFR=0 and PMFC=1 of 802.11w/PMF (Protected Management Frames).

bin4-wpa3-personal-sae (opmode-transition disabled) Beacon frame

f:id:bin4:20200507185751p:plain

In RSN Information Tag, there are AKM (Auth Key Management) 00:0f:ac:8 (SAE) only. In RSN Capabilities, we can see PMFR=1 and PMFC=1 , so 802.11w/PMF is required.

2020-03-08

アルバの便利ツール / Nice tool for Aruba

アルバが提供している便利ツールのご紹介。

Aruba Utilities (Android のみ)

いろいろ機能がついているけど、電波の状況を一覧形式や時系列で表示してくれるので、トラブルシューティングの際にとても便利。BLE (Bluetooth) でにコンソール接続も可能。ただし、Androiod 版のみ。iOS 版もリリースしてくれたらいいのに。

https://play.google.com/store/apps/details?id=com.arubanetworks.arubautilities&hl=ja

Aruba BluConsole (iOS のみ)

BLE (Bluetooth) で AP にコンソール接続するツール。

https://apps.apple.com/jp/app/aruba-bluconsole/id1111461348

[English Version]

Aruba provides several tools. I would like to introduce some of them.

Aruba Utilities (for Android only)

This provides several functions. The most great function is showing WLAN information with a list and timeline base. This also has BLE (Bluetooth) console function.

https://play.google.com/store/apps/details?id=com.arubanetworks.arubautilities&hl=ja

Aruba BluConsole (for iOS only)

This is for BLE (Bluetooth) console function..

https://apps.apple.com/jp/app/aruba-bluconsole/id1111461348

2020-03-08

Kr00k

Kr00k が RSA Conference 2020 で発表されました。YouTubeにプレゼンがアップされてます。

https://www.welivesecurity.com/2020/02/26/krook-serious-vulnerability-affected-encryption-billion-wifi-devices/

https://www.youtube.com/watch?v=_40E6WRMRyE

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15126

Kr00k は WPA/WPA2 の 4-way handshake に関する脆弱性で、Broadcom および Cypress の無線チップを搭載した端末や AP に影響をします。具体的には、disassociation フレームを受信後、暗号キーをすべて0でクリアし、その際に、送信バッファーにフレームが溜まっていれば、すべて0の暗号キーで暗号してフレームを送信します。そのため、悪意を持ったユーザが、disassociation フレームを送信し、無線空間をキャプチャする等して取得し、復号することが可能です。現在の所、Broadcom および Cypress の無線チップから修正コードは出てません（2020.3.8 現在）。

WPA/WPA2 の脆弱性と言えば、2017年に発表された KRACK があります。

https://www.krackattacks.com/

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080

KRACK はプロトコルの脆弱性で全ての端末や AP に影響し、攻撃に成功すると無線フレームを盗み見ることが可能で、影響度が広く、深刻度も高いこともあり、WPA3 が制定されるきっかけとなりました。

一方で、Kr00k は disassociation フレームを受信後の送信バッファー溜まっていたフレームのみ盗み見ることが可能です。送信バッファーに溜まる条件としてはいろいろ考えられますが、通信が大量に発生している、無線空間が一杯である、低速度の無線規格を使用している等が考えらえます。KRACK と比較すると、影響度はかなり低いと思います。

各ベンダーの深刻度です。

Cisco

Aruba

KRACK -> Medium
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
Kr00k -> Low
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt

KRACK、Kr00k ともに言えることは、まずは通信をHTTPS等で暗号化しましょうということですね。上位レイヤで暗号していれば、無線フレームを復号できたとしても、HTTPSで暗号化されているので、見えませんので。

2020/3/14 追記：

3/13付けでアルバの情報が更新されました。さっそくパッチがリリースされるみたいです。

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt

[English Version]

Kr00k is published in RSA Conference 2020. The video is uploaded on Youtube.

https://www.welivesecurity.com/2020/02/26/krook-serious-vulnerability-affected-encryption-billion-wifi-devices/

https://www.youtube.com/watch?v=_40E6WRMRyE

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15126

Kr00k is about WPA/WPA2 4-way handshake vulnerability and affected to station/AP with Broadcom and Cypress chipset. For technically, after receiving a disassociation frame, station/AP resets encryption key as all 0 (zero). If frames are in tx buffer, then station/AP encrypts these frames with all 0 key and sends to air space. Hence, a malicious user sends a disassociation frame and then can decrypt the frames. Fix code is not released from neither Broadcom nor Cypress (as of March 8th, 2020).

You may remember KRACK, which was published in 2017.

https://www.krackattacks.com/

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13080

KRACK is also about WPA/WPA2 protocol vulnerability and affects all station/AP. KRACK influenced all over the WiFi vendors and users and one of the triggers to WPA3.

From my point of view, Kr00k is very limited effect because a malicious user can decrypt the frames which are in tx buffer in station/AP after disassociation frame. I mean, a malicious user can see a small amount of frames only and the condition is limited. From Cisco and Aruba Severity, Kr00k is less than KRACK.

Cisco

Aruba

KRACK -> Medium
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2017-007.txt
Kr00k -> Low
https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt

Ether way, encryption in the application layer is import like HTTPS. If a malicious user can decrypt wireless frames, s/he can not decrypt in the application layer.

14th Mar 2020 added:

On 13th Mar, Aruba has announced they will provide the patches with the fix.

https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2020-003.txt

2020-03-08

ブログを始めました / started blog

ブログ始めました。興味のある分野は、

無線 / WiFi
ネットワーク全般
セキュリティ全般

などなどです。

英語の勉強も兼ねて、英文も併記したいと思います。

[English Version]

I have just started this blog. My interest is

Wireless LAN / WiFi
Network
Security

For improving my English, I would like to write the English version follows Japanese.