Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

21–30 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#21

Post by bongodongobob »

nighthawk454 wrote: post #12
toast0 wrote: post #9

Earlier quoted context omitted.

It's not unusual to run multiple APs on a single SSID. Your scheme doesn't work for that without coordination between the APs. Also, it means replacing an AP would require reconfiguring all the clients.

Couldn't it just fall back to the password version like it does every time now? Like optionally use the keys if present if not renegotiate

I'm guessing that's going to be an issue for handoffs between APs. Think walking around a multi-story office on a Wi-Fi call. Now picture 30 APs and 100 people on wifi calls/VoIP etc. with DHCP recycling addresses, randomized MACs and so forth.

Re: WPA3 Enterprise 192-bit mode at home

#22

Post by spr-alex »

londons_explore wrote: post #8

I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…

shameless plug: https://github.com/spr-networks/super is a project I work on that makes it easier to handle per-device wifi passwords on a single SSID, and it supports WPA3

Re: WPA3 Enterprise 192-bit mode at home

#23

Post by iforgotpassword »

On the topic of WPA3, I recently found that the old iPad 2 or 3 doesn't connect to wifi if it's set to WPA3+2, it only works in pure WPA2 mode. Tried on two different AP vendors, though I have no idea if they might use the same chip or driver or something. It's the only device that didn't work in this mode, everything else was fine, including some whacky iot devices like picture frames and an inverter.

Re: WPA3 Enterprise 192-bit mode at home

#24

Post by Gh0stRAT »

lolinder wrote: post #14
outworlder wrote: post #6

Earlier quoted context omitted.

And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

I want my guests to be able to cast to my TV, add songs to the Spotify queue, etc. As far as I can tell, these sorts of features work via broadcast frames and thus require the relevant devices to be on the same subnet.

Things like my printer and wifi-connected grill live on a much more restrictive VLAN. (with some firewall rules to allow devices on the trusted network to still print to my printer's hard-coded IP address)

Re: WPA3 Enterprise 192-bit mode at home

#25

Post by Rebelgecko »

radicaldreamer wrote: post #15
sandworm101 wrote: post #10

TS information over wifi? Ok. Have fun with that. Im sure it is legally possible somehow, but it just creates a ridiculously large attack surface. And the internal hassles, making sure connected machines are inside defined perimeters ... just run some wires. It isnt like people need to be reading classified stuff on the treadmill.

Does the NSA use WiFi at all other than for clandestine collection systems in the field?

Yeah, they put out an article a few years ago talking about how a limited number of SCIFs have WiFi now

Re: WPA3 Enterprise 192-bit mode at home

#26

Post by bongodongobob »

lolinder wrote: post #14
outworlder wrote: post #6

Earlier quoted context omitted.

And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

I split it off and give it zero access to the Internet, it's strictly internal. Everything can talk to the IoT VLAN, but not the other way around.

Re: WPA3 Enterprise 192-bit mode at home

#27

Post by postpawl »

iforgotpassword wrote: post #23

On the topic of WPA3, I recently found that the old iPad 2 or 3 doesn't connect to wifi if it's set to WPA3+2, it only works in pure WPA2 mode. Tried on two different AP vendors, though I have no idea if they might use the same chip or driver or something. It's the only device that didn't work in this mode, everything else was fine, including some whacky iot devices like picture frames and an inverter.

You’re sure it’s not actually the PMF setting causing that? More details here: https://www.reddit.com/r/Ubiquiti/comments/rq6jtr/psa_if_you...

Re: WPA3 Enterprise 192-bit mode at home

#28

Post by moandcompany »

sandworm101 wrote: post #10

TS information over wifi? Ok. Have fun with that. Im sure it is legally possible somehow, but it just creates a ridiculously large attack surface. And the internal hassles, making sure connected machines are inside defined perimeters ... just run some wires. It isnt like people need to be reading classified stuff on the treadmill.

The "NSA-Grade" part mostly comes from the application of AES-256 as a cipher, where specific configurations of AES were approved as "Suite B" (i.e. published algorithm) ciphers suitable for up to Top Secret information.

From https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography

The Suite B algorithms have been replaced by Commercial National Security Algorithm (CNSA) Suite algorithms:

- Advanced Encryption Standard (AES), per FIPS 197, using 256 bit keys to protect up to TOP SECRET

- Elliptic Curve Diffie-Hellman (ECDH) Key Exchange, per FIPS SP 800-56A, using Curve P-384 to protect up to TOP SECRET.

- Elliptic Curve Digital Signature Algorithm (ECDSA), per FIPS 186-4 Secure Hash Algorithm (SHA), per FIPS 180-4, using SHA-384 to protect up to TOP SECRET.

- Diffie-Hellman (DH) Key Exchange, per RFC 3526, minimum 3072-bit modulus to protect up to TOP SECRET

- RSA for key establishment (NIST SP 800-56B rev 1) and digital signatures (FIPS 186-4), minimum 3072-bit modulus to protect up to TOP SECRET

Re: WPA3 Enterprise 192-bit mode at home

#30

Post by mysteria »

If you want do do this 100% locally it's pretty easy with Pfsense/Opnsense combined with the Freeradius plugin. You can create your CA, hook it up to Freeradius, and create accounts and certificates all from the GUI (if you know what you're doing). As a bonus you can use the same certs with say the built-in OpenVPN system, and revocation of certificates is handled seamlessly in the UI as well. Personally I found it much simpler than doing it by hand with OpenSSL commands, which I used in the past when I had a smaller deployment.

The great thing with WPA Enterprise is that you can assign VLANs based on the client's login, just like a 802.1X switch. For instance my phone is sent to one VLAN, my company laptop to another, and my personal laptop to another. I can use a single SSID and get all the benefits of a multi-VLAN setup. For guests I provide a username and password for MSCHAPv2 authentication, while family devices are issued full certs.

What about IOT devices? I generally only use commercial wired gear (IP phones, cams, etc.) anyways with no internet access, and I'm of the belief that if it doesn't support WPA-Enterprise it shouldn't be on the network in the first place :). So that rules out all those data-mining smart speakers and so forth.

Post reply on HN