1 / 15

Performance Analysis of 802.11 authentication and authorization

Performance Analysis of 802.11 authentication and authorization. Authors:. Date: 2011-11-15. Abstract. This proposal provides analysis of primary delay contributors within RSNA security protocol in accordance with IEEE 802.11i. Conformance w/ TGai PAR & 5C. EAP Authentication Phases

gary
Download Presentation

Performance Analysis of 802.11 authentication and authorization

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Performance Analysis of 802.11 authentication and authorization Authors: • Date: 2011-11-15 Rob Sun etc, Huawei.

  2. Abstract • This proposal provides analysis of primary delay contributors within RSNA security protocol in accordance with IEEE 802.11i. Rob Sun etc, Huawei.

  3. Conformance w/ TGai PAR & 5C Rob Sun etc, Huawei.

  4. EAP Authentication Phases • EAPOL handshake • EAP specific methods Authentication and Key establishment • Key Agreement • Key Generation • Key Transport • 4-Way handshake IEEE 802.11 EAP Authentication and Authorization Delay Contributors Rob Sun etc, Huawei.

  5. Purpose: To initiate the EAP/802.1X based authentication; Components: - EAPOL Start (STA ->AP) - EAPOL Identity Request (AP ->STA) - EAPOL Identity Response (STA ->AP) - EAPOL success/failure (AP ->STA) Primary Delay Contributors T1: - air time transmission .11 EAPOL Handshake Rob Sun etc, Huawei.

  6. Message Frame ACK Frame DIFS CW Preamble Data SIFS Preamble Data Air Time of 802.1X EAPOL messages • SIFS = 16 us; • DIFS = 34 us; • CW = 67.5 us; (average of CWmin); • Preamble:= L-STF (8us)+L-LTF(8us)+L-SIG(4us)+HT-SIG(8us)+HT-STF(4us)+HT-LTF(4us) = 36 us; • Data rate = 6.5 Mbps; (MCS0 in 802.11n) • Results: • EAPOL start air time = 369.1us • EAPOL identity request = 369.1us • EAPOL identity response = 1476.8 us • EAPOL success =369.1us • Total T1= 2584 us =2.5ms • Reference: • Draft P802.11REVmb_D12.0 Rob Sun etc, Huawei.

  7. Purpose : To provide the mutual authentication and RSNA key establishment • Components : EAP Specific Authentication - Different EAP methods are examined for delay comparison Hypothesis : PSK based EAP methods consumes less key establishment time than X.509 certificate based pair-wise key establishment ( reference: RFC 5216, and FIPS SP 800 56A) . Primary Delay Contributor T2: - X.509 certificate verification delay - Key generation delay - Handshake Delay (Air time + Wired Delay) Note1: All EAP methods are assumed using 4 message handshake as per RFC 5216 Note 2: Wired Delay is non negligible but wasn’t calculated EAP Authentication and Key establishment Rob Sun etc, Huawei.

  8. Testing Environment: Server and Client Side: • CPU: PIII 550Mhz • RAM: 256M • OS: Windows XP • HD: 40G • Simulation Software: OpenSSL (Open source toolkit for TLS) • # of Iterations: 100,000 Performance of various EAP methods and EAP-PSK methods Rob Sun etc, Huawei.

  9. Both Client and Server processing time including the following operations • Initialization • Key Processing • Signature Processing • Tested Candidates: 1) EAP-PSK (RFC 4764) 2) EAP-TLS w/ cipher suites of DHE-DSS-1024 3) EAP-TLS w/ cipher suites of RSA 1024 (PKCS #1) • For DHE-DSS-1024 with mutual authentication • For RSA 1024 with server authentication Client and Server processing time Rob Sun etc, Huawei.

  10. Client and Server processing time Rob Sun etc, Huawei.

  11. Purpose: To establish the trust and derive the over-the-air session keys between STA and AP • Component: • Initialization (Nonce generation) • MIC calculation • KDF function • 4 EAPOL key messages • Primary delay contributors T3: - KDF function - Handshake air time Note: same testing environment 4-Way Handshake Processing Time Rob Sun etc, Huawei.

  12. Total Time consumed by RSNA authentication and key establishment is: • 802.1X EAPOL over the air handshake contributes minimum in overall delay ( T1<3ms) • 4 way handshake doesn’t contribute major delay (T3<7ms) • Major delay contributor is from EAP authentication with chosen methods (T2) • Potential Reasons 1) Certificates verification 2) Finite Field Prime number modular calculation and DLC hard problem • EAP-PSK demonstrates ideal performance in key establishment and is suitable for FILS authentication (with <20ms) . • EAP-TLS with X.509 certificate based authentication options and key establishment imposes tight time budget in satisfying the performance objectives of TGai. Conclusion Rob Sun etc, Huawei.

  13. Even though the choice of EAP methods are out of scope of IEEE 802 working group, would it be necessary to promote EAP-PSK as the candidate for the FILS authentication specific method? • DHCP and DNS are both the major contributors of the delay, pre-establishment should be ideal for TGai. Further discussion Rob Sun etc, Huawei.

  14. RFC 5216 RFC 4764 RFC 2246 and RFC 2246-bis-13 Draft P802.11REVmb_D12.0 FIPS SP 800 56A FIP 140-2 annex C RSA PKCS #1 References Rob Sun etc, Huawei.

  15. Questions & Comments Rob Sun etc, Huawei.

More Related