How Many Bits, and Does It Matter?

How WEP Works

WEP protects data moving across a wireless network by encrypting the traffic that passes between wireless access points and client adapters like PCMCIA cards inserted into laptops or PDAs, and PCI cards inside desktop machines. Once WEP is operating, an outsider with a wireless packet sniffer will see packets full of jumbled and apparently random numbers and letters.

The encryption algorithm WEP uses is a 'stream cipher' called RC4, which was developed by RSA Security quite a few years ago. RC4 was chosen because it's fairly simple and fast-running. Using RC4 slows down a network much less than a more complex algorithm would. Explaining the WEP encryption mechanism step-bystep, while interesting, is not very useful if all you want to do is use it-and explaining it well would take more space than I can give it in this book. If you're curious, dial up this Web document:

http://vip.poly.edu/mehdi/wep.pdf

Be warned: It's very technical-but it's the best explanation I've seen online so far of how WEP works and how hackers break it. A less technical presentation (actually, a PowerPoint slide set) is available at the following Web site:

http://www.cacr.math.uwaterloo.ca/conferences/2001/isw-eighth/slides/slides/Borisov.ppt

From a user's standpoint, WEP's operation is fairly simple:

• The user generates four different encryption keys. For the standard 64-bit encryption that all Wi-Fi devices understand, each key is a 10-digit 'hexadecimal' (base 16) value. You can create a key by picking ten random hex digits out of the air. A hex digit may be any number from 0 to 9, plus the letters A to F. A key looks something like this: 916C5B77AF. Many modern access points include a utility that will generate these four keys for you, from a pass phrase, which is a sequence of letters or words like 'stoddlemerry' or 'hoodle the infrey.' On a given adapter, the same pass phrase will always generate the same four keys.

• The user then distributes the four keys to all client adapters that will connect to the access point. This process- key distribution -is a crucial issue in Wi-Fi security. It may require typing in forty hex digits with absolute accuracy- uggh!-but it can often be done by typing in the same pass phrase into a utility running on all your client machines. Different models work in different ways. Linksys hardware, for example, allows you to use a pass phrase. Much early hardware from Cisco and Agere required manual entry of all four keys. Most modern hardware uses a pass phrase-driven key generator. The difficulties of key distribution will be resolved by upcoming enhancements to Wi-Fi, including Wireless Protected Access (WPA) and, further out, the IEEE task group 802.11i.

• Once your access point and all client adapters belonging to your network have all four keys, you can enable WEP, and at that point all traffic between the access point and the client adapters will be encrypted.

• Nothing more needs to be done until such time as you decide to change keys. It's a good idea to do this now and then; weekly, if possible but monthly is okay.

I've written a detailed description of how to enable WEP in Chapter 14.