2 cissp ® Official Study Guide Eighth Edition

265
WiFi Protected Access
WiFi Protected Access (WPA) improves on WEP encryption by 
implementing the Temporal Key Integrity Protocol (TKIP), eliminating the cryptographic 
weaknesses that undermined WEP. A further improvement to the technique, dubbed 
WPA2, adds AES cryptography. WPA2 provides secure algorithms appropriate for use on 
modern wireless networks. 
Remember that WPA does not provide an end-to-end security solution. It 
encrypts traffic only between a mobile computer and the nearest wireless 
access point. Once the traffic hits the wired network, it’s in the clear again.
Another commonly used security standard, IEEE 802.1x, provides a fl exible framework 
for authentication and key management in wired and wireless networks. To use 802.1x, 
the client runs a piece of software known as the
supplicant
. The supplicant communicates 
with the authentication server. After successful authentication, the network switch or wire-
less access point allows the client to access the network. WPA was designed to interact with 
802.1x authentication servers.
Cryptographic Attacks 
As with any security mechanism, malicious individuals have found a number of attacks to 
defeat cryptosystems. It’s important that you understand the threats posed by various cryp-
tographic attacks to minimize the risks posed to your systems: 
Analytic Attack
This is an algebraic manipulation that attempts to reduce the complexity 
of the algorithm. Analytic attacks focus on the logic of the algorithm itself. 
Implementation Attack
This is a type of attack that exploits weaknesses in the implemen-
tation of a cryptography system. It focuses on exploiting the software code, not just errors 
and fl aws but the methodology employed to program the encryption system. 
Statistical Attack
A statistical attack exploits statistical weaknesses in a cryptosystem, 
such as fl oating-point errors and inability to produce truly random numbers. Statistical 
attacks attempt to fi nd a vulnerability in the hardware or operating system hosting the 
cryptography application.