WEP passwords

[milanuk]

Here's a question for anybody who is 'up' on wireless encryption and all that...

I have a Linksys WRT54G wireless router and gateway - does a fair number of neat things such as stateful packet filtering firewall, DHCP server, etc. Overall it works pretty well. The one thing thats always been kind of a PITA though is when I have WEP encryption enabled, some computers can connect just fine using the 'passphrase', i.e. the plain-text password that the actual 128bit login is generated from (as I understand it)... and some can't - I end up having to use the full 26 digit hex code for those machines. My wife is a teacher, and regularly has groups of teachers over to work on stuff - they don't like it when their Macbooks can't connect thru the 'Net to their secure fileserver back at the school, so I either have to write down the hex code for them along w/ the SSID, or I have to drop the encryption for the day, and *hope* I remember to put it back on before some neighborhood hoodlum hacks my router/firewall and locks me out of my own network (BTDT). It's not just Macs, either... occasionally the kids might have a friend over who has a PC laptop, and most of *those* don't like the passphrase either.

I was kind of baffled by this until today (well, still am, which is why I'm asking here )... I was setting up a new wifi HP Photosmart C6380 All-in-One (printer/scanner/copier) and was typing in the passphrase on the little screen keyboard (makes typing an email on a cellphone look easy)... and of course it didn't like the passphrase either. It *did* however, give me a useful (I think) error message - basically it told me the passphrase had to be either 5 or 13 characters, corresponding to a 10 or 26 digit hex code... I looked at it, and sure nough, my pass phrase was 9 characters, not 5 or 13.

So my question for y'all is... is this most likely what the problem has been all this time - that some of the computers just didn't want to take a weird length pass phrase because it wasn't right? Why wouldn't they have flagged it with an error message? I'm a little hesitant to go changing the pass phrase and then have to go farting around with all the local computers, printers, etc. to see if its going to work or not. Messing with computers is fun... but not quite that fun

[OpaDC]

from http://www.tech-faq.com/wep-wired-eq...-privacy.shtml


WEP Key Generation

Most 802.11 devices allow WEP keys to be entered using an ASCII passphrase or in hexidecimal format. The conversion between these two formats is an industry standard which is shared by almost all vendors of 802.11 equipment.
Some 802.11 devices have difficulty using ASCII passphrases or use a non-standard conversion algorithm. For those devices, you will need to use the hexadecimal version of your WEP key.

Maybe this is the problem?

[just started]

You have the hex that your system accepts so just translate that back to ascii and see what your router used as fill-in to get to 13.

I have gone to just using the hex since I have the same problem all the time (always with Windose though) and I'm not sure but I THINK it might be due to the default character set being sightly different on different machines.

Also, don't forget that case matters.

[LinuxRandal]

I don't know the answer to your question, but my father had something similar with Wireless and users. When we found an inexpensive wireless router, he bought it (originally with intent as an extender), and left it turned off. When someone not in the network needs it, he just turns that one on.

[LCHIEN]

I think OpaDC has it correctly - that using a ASCII paraphrase to generate a key is not a standard or even offered by all vendors. I have had a string of devices in my house over the years and some offered using ascii phrases and some did not. Those that did I was not sure they used the same algorithm to generate the same HEX key. Only is they were made by the same manufacturer would I use the ascii phrase. When I got the second or third device and it did not support the ascii phrase, I gave up using it. I think its just a convenience device. I have a old, small thumb drive on top of my computer and it has a text file with the HEX key - I just take that to the new computer and copy and paste the key into the setup screen now.

[milanuk]

Well, that makes me feel a little better... it's not just me screwing something up

I'll admit, I'm kind of disappointed that the various manufacturers can't use a common conversion from ASCII to HEX... how friggin' hard is that? But noooo... everybody has to have their little proprietary touches to break things when you don't use *just* their components

[LCHIEN]

well they don't just take the hex values of the ascii characters and put them in the hex fields. That would be oversimplistic and use only a small subset of the possible hex values. if your phrase was short or long them it would not be able to generate the correct length. The art of generating randomish strings of binary or hex values of a given length from a repeatable phrase is similar to what we called hashing in the old computer algorithm lingo... there are many hashing approaches and algorithms. The WEP part of the 802.11 standard just specified the number of hex digits and did not specify any ascii phrase generation algorithms, manufacturers added that later I think as a convenience and there was no standardization.

[Rich P]

One approach is the make up the hex key up yourself using all numbers or some combination of A thru F plus numbers that means something to you. Then you have a prayer of remembering them without writing them down (which of course sends chills up the spine of the security folks ). For example a date with a 4 digit year will give you 8 hex characters. Three dates plus your lucky number and you have 26. Easy-peesy.

[gerti]

WEP is quite easy to crack. If possible you should switch to WPA.

[DaveS]

WEP is quite easy to crack. If possible you should switch to WPA.

Agreed.

WEP is to network protection what a "no trespassing" sign is to keeping people off your property - it will only stop the honest people, not the ones you are really trying to keep out.

[LCHIEN]

Agreed.

WEP is to network protection what a "no trespassing" sign is to keeping people off your property - it will only stop the honest people, not the ones you are really trying to keep out.

Well, its not quite that bad.
most people know how to climb a fence but there's still only a small percentage of people who have the knowlege to crack a WEP. They have to have the time, equipment, access (300 feet of your house) and software an the desire/motive to get into your network.

If you have WAP, I'd definately use it in preference to WEP. Those with older equipment and no WAP, WEP is still a whole lot better than a NoTresspassing sign or no security at all. WEP should not be your only line of security, anyway.

[Kristofor]

Well, its not quite that bad.
most people know how to climb a fence but there's still only a small percentage of people who have the knowlege to crack a WEP.

This is true, but the amount of overlap between the people with this knowledge and the ones who would want to cause mischief on your network is quite high....

IMO forget about the concept of a secured perimeter, lock down the devices, and try to prevent abusive usage rather than access to the feed...

Getting back to the original poster, if you want to let these various people have access to your internet connection, what type of government required tracking system do you plan to implement if the Internet Saftey Act is passed(Senate S.436, House H.R.1076)? Teachers tend to have lots of access to children so that's exactly the types of people this bill wants to keep tabs on...

[milanuk]

The WEP encryption will go bye-bye as soon as I yank the eMac (G4-700mhz) from the home network - it's ancient Airport card only supported WEP, which is why I didn't move to WPA years ago.

Internet Safety Act... sorry, I've been too busy keeping up with all the anti-gun legislation that the gov't wants to ram through to keep up with all the 'big brother' B.S. too...

[DaveS]

Well, its not quite that bad.
most people know how to climb a fence but there's still only a small percentage of people who have the knowlege to crack a WEP. They have to have the time, equipment, access (300 feet of your house) and software an the desire/motive to get into your network.

(ok, one more then I will stop... I promise)

I guess I am paranoid.

Just google "crack wep". It doesn't take long to come up with the goods.

One laptop, some free, easily obtainable software (*cough*aircrack*cough*) and about 10 minutes will do it. I guess a directional antenna might help if you were more than a couple hundred feet away.

It really is false security.

I guess a better analogy would be locking your car doors - everyone knows that there are people that can open your car without the key or the fob in less than 30 seconds. And that's not counting those that would break a window to get in. Most people understand that just locking your car door does not protect valuable things inside from being stolen.

To me, this is kind of like that. Securing your network with WEP only keeps the honest people out.

I sit across the hall from my company's security research team, and I am afraid for the safety of my data.

[LCHIEN]

yeah after doing some research on the 'net the WEP is pretty weak. Especially if you used the ASCII text paraphrase to generate a key rather than some random hex digits. Using the ascii text key generator and your cracker using a standard english dictionary to break your code is really, really weak since it reduces the complexity of the key drastically.