Is WPA2 security broken due to Defcon MS-CHAPv2 cracking?

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by peterwwillis on Tuesday August 07, 2012 @10:23AM (#4350197)

As part of the new Baseline Requirements for public CAs, certificate authorities are not able to issue certificates for internal purposes after 2015.

This means that your client will have to have the certificate installed on it prior to authentication. So a random person connecting to your AP may be subject to an untrusted certificate, or require manual installation before connecting.

So.... in 2015, we might be fucked.

[ Parent | on HN ]

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by comex on Tuesday August 07, 2012 @04:54PM (#4352236)

Can't you get around that by just using a real domain name? There's no requirement that the server be accessible externally.

[ Parent | on HN ]

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by peterwwillis on Wednesday August 08, 2012 @10:02AM (#4355563)

There's no guarantee the CA won't revoke it if they find out you're using it for internal purposes.

[ Parent | on HN ]

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by comex on Wednesday August 08, 2012 @02:11PM (#4357064)

That makes no sense - there is no security problem with using a legitimate certificate for a real domain for internal purposes.

I haven't heard about these Baseline Requirements before your post, but http://www.cabforum.org/Baseline_Requirements_V1.pdf mentions 2015 but only in the context of reserved IPs and "Internal Server Names", which is defined as "A Server Name that is not resolvable using the public DNS". That makes more sense, because there is no way to say who owns such a domain.

Am I missing something?

[ Parent | on HN ]

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by apendleton on Tuesday August 07, 2012 @10:30AM (#4350226)

This article assumes self-signed certs anyway, and specifically addresses procedures for disseminating them.

[ Parent | on HN ]

Re:Is WPA2 security broken due to Defcon MS-CHAPv2 cracking? by peterwwillis on Tuesday August 07, 2012 @10:44AM (#4350302)

The article mentions how to work with self-signed certs, but that is not the point. Many orgs don't run their own root CA because the cost of supporting all the devices just to auth securely is overwhelming, and just buying one cert from VeriSign is enough to keep it secure. Except when 2015 rolls around. If you maintain wireless networks for large enterprises, it's kind of a big deal.

[ Parent | on HN ]