I try not to use wifi as much as possible, but when I do, I connect through it to my home VPN or similar and take it from there, so even if the wifi is compromised, there’s an extra layer of protection there.
WPA3 Enterprise 192-bit mode at home
131–140 of 201 posts
Re: WPA3 Enterprise 192-bit mode at home
#132Earlier quoted context omitted.
Huh? Almost every cryptographic session protocol starts out with the parties sending unauthenticated data of some sort to each other. Having a way for a party to send a blob as part of its request to be let in is straightforward. Plus we’re taking about WPA, which, AFAIK, still uses a horrible hack for EAP even in WPA3, and as you can see mentioned elsewhere in the comments, EAP makes a pretty strong showing in its q…
Their was a defcon or a blackhat talk on this issue. Even though the data might be encrypted....developers can leak so much metadata via the handshake that you can build profiles and track devices
The entire point of what I’m suggesting is to have a device identify itself.
If you set your phone to randomize its MAC address, then it should not send anything that specifically identifies it. If you ask your printer to connect to your corporate wireless network and you tell it to use WPA4-self-provisioning or whatever it’s called, then it should fully identify itself. Also, it’s a printer, and anyone in WiFi range is presumably privy to its existence.
Sure, if someone else spoofs the network, then they might collect the printer’s provisioning info, but one way or another the printer needs to decide to trust whatever network it ends up connecting to. And with a sufficiently well designed protocol, if the printer connects to the wrong network, then the owner of that network can’t actually impersonate the printer to the real network, because the derived keys won’t match.
Re: WPA3 Enterprise 192-bit mode at home
#133Do these enterprise modes have any advantages when it comes to connection reliability?
You're not going to increase connection reliability/extend your wifi range by enabling radius. If you have any understanding of what's happening here, you wouldn't even ask this question.
What I’m wondering has nothing to do with signal strength. I’m wondering if the protocol differences have any effect on reliability in situations where the wireless connection is less reliable. Because, for example, there’s less negotiation on reconnecting to the network or something.
After all, reliability is a cross-cutting concern :)
Re: WPA3 Enterprise 192-bit mode at home
#134Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…
Would love to hear more about how you provision wireguard. I have a simple VLAN setup where I can open a tunnel from my "guest/home" network to my "lab" network (ie. docker hosts, desktop PCs that I use for development, etc) and a second tunnel from the lab network to the network that can access mgmt interfaces, however it's all mostly manual (ie. sudo wg-quick up in a terminal)
Tailscale. It's Wireguard under the hood but with a company doing got UX on top.
Re: WPA3 Enterprise 192-bit mode at home
#135Earlier quoted context omitted.
Well... the title is hyperbolic (as titles are wont to be), but the goal was to configure Wifi that aligns with the CNSA Suite[1] / CNSSP 15[2], which I think is fair to call "NSA-grade" since they wrote the standard. If the NSA wants to get a certificate that your system trusts there are already dozens of organizations with root certs in your system trust store that they can strongarm. Most organizations can't affor…
Historically, cryptosystems are broken through weaknesses in key distribution, not by cracking the encryption outright.
Correct.
Re: WPA3 Enterprise 192-bit mode at home
#136Well, that means I couldn't use my iPhone from work at home as it blocks installing certificates.
But, while not NSA approved, WPA3 itself has support for per-device passwords with WPA-SAE [0] (which isn't called WPA-METRIC outside of the USA...).
[0] https://en.wikipedia.org/wiki/Simultaneous_Authentication_of...
Re: WPA3 Enterprise 192-bit mode at home
#137> Toggle the switch on the Smallstep RADIUS Root CA to enable Full Trust. The Smallstep RADIUS Root CA is now trusted. What could possibly go wrong? How do you do this without trusting some external CA?
right!? i was hoping this would be a guide with something like freeradius and letsencrypt/acme to handle certs instead of yet another rando “free until we go under/get bought” saas service
You can roll your own with https://github.com/smallstep/certificates. We maintain major open source projects and contribute a lot to other projects. I don’t think that means everything we do has to be open source. Sorry this one wasn’t. Doing this in pure open source would be a book, not a blog post.
Love Let’s Encrypt — we’re sponsors — but using them for WiFi is a terrible idea. You need internal PKI for WiFi.
Re: WPA3 Enterprise 192-bit mode at home
#138Earlier quoted context omitted.
As someone noted above the Commercial Solutions for Classified program has been in existence for a long while (probably over a decade). This package is newer but not wildly newer. Installs of the various 'packages' do exist.
Huh interesting. I can't imagine where people would willingly use it.
[deleted]
Re: WPA3 Enterprise 192-bit mode at home
#139Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…
We already have .1x which supports various auth methods such as certificate auth and can use policies to assign clients to VLANs
Re: WPA3 Enterprise 192-bit mode at home
#140Instructions ... yeah, not bad. It's essentially WPA3-Enterprise with possibly 192 bit set up. I like WPA3-Enterprise, it's really sufficient for most people when one moves to discontinuous permissions on a network.
That said, after developing WPA3/Enterprise/192 for a platform out there, it's really very very restricted - and there were very few clients at the time that supported the combinations of security authentications required. Oh, also roaming clients is somewhat restricted (by no fast roaming protocols, at least as of the last time I went through the specs).
Here's specifics, using hostap/wpa_supplicant style configuration: key management WPA-EAP-SUITE-B-192. (but then they talk about that); pairwise=GCMP-256, group_mgmt=BIP-GMAC-256; EAP=TTLS;
I mean RADIUS support isn't that hard - freeradius will do. TLS - well, need valid certs that work for EAP. (it's not as specialized as Passpoint/Hotspot-2, which requires custom certs that must be validated by a specific CA, but it still takes some steps). My own experiments across a number of clients showed that GCMP-256 support for pairwise and group management weren't that common before Wifi-6 took off. Suite-B 192 though isn't so hard to reach.
Hostly, I prefer WPA3-Enterprise with Fast Roaming. Sadly, typical household devices didn't work well with it (mixed with android devices, generally no for printers and other IOT), so I went back to two networks - WPA2/Personal with PMF=optional for those annoying devices that don't have working PMF, and WPA3/Personal for most devices - at least for household operations.