Home page logo

basics logo Security Basics mailing list archives

RE: 802.1x and PEAP
From: "Rosenhan, David" <David.Rosenhan () swiftbrands com>
Date: Mon, 8 Mar 2004 08:08:14 -0700

I checked that out also and found that most of those devices support
LEAP but not the Cisco version of TKIP and WEP.  I also found that most
of them also support WPA with a software and driver upgrade.


David Rosenhan, CCNP
Information Technology

-----Original Message-----
From: Camillo Bucciarelli [mailto:camillobucciarelli () yahoo it] 
Sent: Monday, March 08, 2004 3:39 AM
To: Rosenhan, David
Cc: security-basics () securityfocus com
Subject: RE: 802.1x and PEAP

On the Cisco's website I've found a list of
"Compatible devices":

I think that this devices support the basic Wireless
Operation but not the TKIP+MIC. What do you think?


 --- "Rosenhan, David"
<David.Rosenhan () swiftbrands com> ha scritto: > True,
Cisco was one of the first vendors to even
make it available.
WiFi or the IEEE hadn't come out with any true
standard yet so Cisco
basically built their own, this is why you can't use
another vendors
card and have TKIP with MIC and WEP enabled on a
Cisco AP.  But I am
right when I say that no other card (that I have
tried or that I know
of) then a Cisco card will work with a Cisco AP
running WEP+TKIP+MIC. 

However with the new IBM T40 built in wireless card
you can use the new
Cipher suite Cisco implemented in the IOS code on
the 1200's, 350's and
1100's (after a free download of the software from
the IBM website which
includes IBM's Application software and driver
updates) This integrates
WPA with TKIP using the IEEE standard, it also works
with Cisco LEAP and
with regular EAP.  

There is an option above the Cipher suite option
that is Cisco
proprietary MIC and TKIP used with WEP in the IOS
code.  I have spent
countless hours testing all of this so if you need
more info then let me

David Rosenhan, CCNP
Information Technology

-----Original Message-----
From: Rosado, Rafael (Rafael)
[mailto:rarosado () lucent com] 
Sent: Friday, March 05, 2004 6:32 AM
To: Rosenhan, David; Camillo Bucciarelli
Cc: security-basics () securityfocus com;
shankarnarayan.d () netsol co in
Subject: RE: 802.1x and PEAP


I disagree with your comment about TKIP and MIC
being proprietary.  TKIP
MIC are part of the Wifi Alliance's interim solution
to WEP deficiencies
which are a subset of the Wifi Protected Access
solution of IEEE 802.11i
(still in draft, expected to be ratified sometime
2nd-3rd QTR 2004).
has a proprietary version of TKIP, but it is based
on the framework
estabished by the WiFi Alliance. 

Rafael Rosado, CISSP, CISA
IT Security Manager
Lucent Technologies
IT Infrastructure - Network Design
2400 SW 145th Avenue 
Miramar, Florida 33027 
Office: 954-885-2176 
Facsimile: 954-885-3861 
Email: rarosado () lucent com 

This electronic mail message contains information
belonging to Lucent
Technologies, which may be confidential and/or legal
privileged. The
information is intended only for the use of the
individual or entity
above. If you are not the intended recipient, you
are hereby notified
any disclosure, printing, copying, distribution, or
the taking of any
in reliance on the contents of this electronically
mailed information is
strictly prohibited. If you receive this message in
error, please
immediately notify us by electronic mail and delete
this message.

-----Original Message-----
From: Rosenhan, David
[mailto:David.Rosenhan () swiftbrands com] 
Sent: Thursday, March 04, 2004 3:18 PM
To: Camillo Bucciarelli
Cc: security-basics () securityfocus com;
shankarnarayan.d () netsol co in
Subject: RE: 802.1x and PEAP


Broadcast key rotation can only be done with an
authentication server. 

TKIP and MIC are Cisco proprietary, if you have an
AP running VXWorks
not IOS they you won't get a different vendors card
other then a 340 or
card to work with TKIP and MIC, period, even if you
upgrade to IOS a
different vendors card will not work with TKIP and
MIC, but there are
options with IOS.

If you upgrade to IOS on your AP (1200's and 350
AP's are up-gradable to
IOS) then you have some new options, you can now use
new IEEE standards
WPA, the problem is the manufacturers card has to
support it.  WPA is
new, even with Cisco 340 and 350 cards you have to
use a separate piece
software (Like the Funk Odyssey client) to use WPA
pre-shared keys.
also included TKIP with WPA and you don't need a
server to use it with
new IOS software on the 1200 and 350 AP's.
Plus there are options for EAP with WPA and
broadcast key rotation with
authentication to a RADIUS server (Cisco has doc's
that talk about how
ACS server works with all of this on their website).


David Rosenhan, CCNP
Information Technology

-----Original Message-----
From: Camillo Bucciarelli
[mailto:camillobucciarelli () yahoo it]
Sent: Thursday, March 04, 2004 8:43 AM
To: shankarnarayan.d () netsol co in
Cc: security-basics () securityfocus com
Subject: RE: 802.1x and PEAP

Can I  use these features(Enhanced MIC verification
for WEP, Temporal
Integrity Protocol, Broadcast WEP Key rotation) with
a non-cisco
Such as a 3com wireless PCMCIA? 
Actually I've tried a cisco aironet 340 wireless

Camillo Bucciarelli

 --- shankarnarayan.d () netsol co in ha scritto: >
This can be done best
the wireless networks
having AP's from Cisco. The
others are still in the process of accomplishing
the same on their 
Access Points (most have done it, some are yet to
accomplish the 
same). The broadcast key is negotiated for the
first time and then the

same is changed at periodic intervals
(configurable by an 
administrator). The old broadcast key is used to
encrypt the new key 
and the same is broadcast out to all the clients
on the access point 
at the expiry of the administrator defined time
limit. On a Cisco you 
would use the following commands on the Aironet
1100/ 1200 (with IOS) 
in order
BM_1036542configure terminal
interface dot11radio { 0 | 1 }
broadcast-key change seconds

=== message truncated === 

Camillo Bucciarelli

Yahoo! Mail: 6MB di spazio gratuito, 30MB per i tuoi allegati,
l'antivirus, il filtro Anti-spam

Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off
any course! All of our class sizes are guaranteed to be 10 students or less
to facilitate one-on-one interaction with one of our expert instructors.
Attend a course taught by an expert instructor with years of in-the-field
pen testing experience in our state of the art hacking lab. Master the skills
of an Ethical Hacker to better assess the security of your organization.
Visit us at:

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]