Enhancing MAC Address Privacy and Security Association in IEEE 802.11
Explore a solution in IEEE 802.11 for maintaining privacy and security when changing MAC addresses. This proposal allows for PMKSA caching while enabling MAC address changes to enhance security associations. Learn about the high-level solution model, requirements, and implementation details for seamless association with improved privacy and security measures.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
October 2021 doc.: IEEE 802.11-21/1697r0 MAC Privacy and PMKSA Caching Date: 2021-10-21 Authors: Name Michael Montemurro Affiliations Self Address Phone email montemurro.michael@gmail.com 250 Innovation Drive, San Jose CA 95134 16340 W Bernardo Dr, San Diego CA 92127 RTP 7, Research Triangle Park, NC 27560 Nehru Bhandaru Broadcom Ltd. +1 408 922 5924 nehru.bhandaru@broadcom.com Thomas Derham Broadcom Ltd. thomas.derham@broadcom.com jerhenry@cisco.com Jerome Henry Cisco Submission Slide 1 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 Abstract When dot11MACPrivacyActivated is equal to True, a STA cannot change its MAC address without all state with a BSS, including the security state. This contribution provides a means for a STA to maintain a PMKSA while allowing its MAC address to be changed. Submission Slide 2 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 High Level Solution Description The model for association is as follows: STA associates to a BSS with a first random MAC address and establishes an SA As part of the security association, a PMKID is generated. STA disassociates from network STA changes MAC address to new random address. STA attempts to associate to BSS with cached PMK and the PMKID. AP recognizes the PMKID and STA establishes a new SA (and generates a new PMKID) Note that any network state associated with the old MAC address would be lost. Submission Slide 3 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 Requirements The AP and STA would advertise/negotiate an association with this capability. A new PMKID will be generated for each subsequent association (to prevent tracking) The STA and AP generate a new PMKID (rPMKID) each association The feature expedites the establishment of a security association changing the MAC address will affect bridging and higher layer communications. The solution will work for any AKM. Submission Slide 4 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 Solution AP advertises support for rPMKSA caching in Extended RSNE STA associates and signals intention to use rPMKSA caching A new PMKID will be generated for each subsequent association (to prevent tracking) The STA and AP generate a new PMKID (rPMKID) each association If this feature is supported by both STA and AP, the STA includes the rPMKID in the PMKID List field at Association. NOTE: The feature expedites the establishment of a security association changing the MAC address will affect bridging and higher layer communications. Submission Slide 5 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 rPMKID derivation Recently, TGaz and TGbe provided a generalized scheme for deriving new keying material from the PTK. The rPMKID is derived from the PTK (KDK) for each association: (NOTE: FT and FILS have different PTK derivations) Submission Slide 6 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 rPMKID Derivation Options Adopt an approach using the KDK based on TGba D8.0 and TGaz D2.6: Option 1. Using IEEE 802.11 KDF rPMKID = L(0, 128, HMAC-HASH(KDK, "rPMKID expansion") Option 2. Using IETF RFC 5869 rPMKID-PRK = HKDF-Extract(current PMKID, KDK) rPMKID = HKDF-Expand(rPMKID-PRK, "rPMKID expansion", 16) Submission Slide 7 Michael Montemurro, Self
October 2021 doc.: IEEE 802.11-21/1697r0 Next Steps Include as an issue for P802.11bi Use Case Provide a mechanism for a STA to use a cached PMK while changing its MAC address STA associates to AP and generates PMKSA/PMKID STA disassociates or loses connectivity STA changes MAC address STA associates to AP with new MAC address and cached PMK Submission Slide 8 Michael Montemurro, Self
