> Toggle the switch on the Smallstep RADIUS Root CA to enable Full Trust. The Smallstep RADIUS Root CA is now trusted.
What could possibly go wrong?
How do you do this without trusting some external CA?
WPA3 Enterprise 192-bit mode at home
11–20 of 201 posts
Re: WPA3 Enterprise 192-bit mode at home
#12I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…
It's not unusual to run multiple APs on a single SSID. Your scheme doesn't work for that without coordination between the APs. Also, it means replacing an AP would require reconfiguring all the clients.
Couldn't it just fall back to the password version like it does every time now? Like optionally use the keys if present if not renegotiate
Re: WPA3 Enterprise 192-bit mode at home
#13I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…
I guess the problem is it's the same until after the initial connection. And it not even clear that it is strictly better. It probably is, but now you are relying on two schemes instead of one so if the second scheme is broken you are worse off.
Re: WPA3 Enterprise 192-bit mode at home
#14Earlier quoted context omitted.
You can run multiple SSIDs on the same AP and segment your networks with VLANs. No need to buy multiple APs unless you need the coverage.
And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.
Is there a reason you split IoT stuff off of the guest network?
On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.
Re: WPA3 Enterprise 192-bit mode at home
#15TS information over wifi? Ok. Have fun with that. Im sure it is legally possible somehow, but it just creates a ridiculously large attack surface. And the internal hassles, making sure connected machines are inside defined perimeters ... just run some wires. It isnt like people need to be reading classified stuff on the treadmill.
Does the NSA use WiFi at all other than for clandestine collection systems in the field?
Re: WPA3 Enterprise 192-bit mode at home
#16A middle ground in complexity is WPA3 with a unique passphrase per VLAN, which allows grouping of devices by risk, or even giving each device a unique identity for access control and traffic management. OSS golang reference code is available, https://news.ycombinator.com/item?id=38402289 VLAN tagging per SSID is a valid approach as well if a router supports it. Thats a lot stronger than how many routers implement the…
My home network is so small I just use MAC VLAN policies on my managed switch. Same SSID and PSK for all devices makes it easy and they all go off onto the untrusted VLAN by default.
Re: WPA3 Enterprise 192-bit mode at home
#17> However, if you want a home network that’s simple to configure, easy for your guests to borrow, hassle-free, and that all of your Smart Home gadgets can connect to, then you should close this tab now Or do what I do: run multiple APs. I have my primary one, which is very tightly secured and monitored, and only gives access to my local VPN. I have a guest one, which is only as secure as any average AP and gets you i…
You can run multiple SSIDs on the same AP and segment your networks with VLANs. No need to buy multiple APs unless you need the coverage.
Yeah this is what I do. Both guests and naughty cloud devices get put on the same LAN as everyone else but can only talk to the gateway and the internet.
Re: WPA3 Enterprise 192-bit mode at home
#18Yea I wish I could run my router with PMF enabled and WPA2…so many devices do BOT support such options…specially WPA3
Re: WPA3 Enterprise 192-bit mode at home
#19Earlier quoted context omitted.
And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.
Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.
I guess it depends on what kind of friends you have, but assuming iot devices are insecure rubbish, I wouldn't want them on the same network as guests. But then again you might want to turn on client isolation for the guest network, so that wouldn't really be an issue.
Re: WPA3 Enterprise 192-bit mode at home
#20EAP-TLS is generally a great practice, as EAP-PEAP is vulnerable to MITM issues (fix proposed in https://www.ietf.org/archive/id/draft-josefsson-pppext-eap-t... but never adopted).
For the use case cited -- blocking MAC spoofing, EAP-TLS doesn't quite solve it, it mainly only solves authentication. The outer layer is not wrapped with TLS and is instead based on an ephemeral session key. Additional work is needed to stop the spoofing. The RFC states explicitly that channel binding, which would help stop the MAC spoofing, is not implemented https://datatracker.ietf.org/doc/html/rfc5216. What it does prevent is a client from being man-in-the-middled.
What's even wilder is that on some access points, when set to bridge mode, with an upstream Radius Authentication Server, as described, they may be vulnerable to ARP spoofing of the upstream radius server IP. This is something we've reported to vendors and were told "won't fix". Names include Netgear and TP-Link, though we don't suspect all routers from them are affected by this. We have not tested with the unifi access point referenced in the article.
So to restate the attack, cause it's so ridiculous, you should know about it: an anonymous, unauthenticated wireless station associates without a password. Next it would begin the EAPOL negotiation but it instead then proceeds to perform ARP spoofing to claim the IP address of the upstream Radius that is supposed to only be routed over the uplink interfaces. Even without knowing the shared secret, it's possible for the client to pretend to be the radius server to the AP, and authenticate itself onto the network. One thing you want to be very sure of when setting up 802.1X Radius Auth, is that your access point is not going to be misconfigured to allow clients to do this.