Authenticated Key Management; Encryption Methods - Cisco 7925G Administration Manual

VoIP Wireless Network
Auto (AKM)
This section describes the following concepts:
•
•

Authenticated Key Management

The following authentication schemes use the RADIUS server to manage authentication keys:
Wi-Fi Protected Access (WPA)
Cisco Centralized Key Management (CCKM)
With WPA and CCKM, encryption keys are not entered on the phone, but are automatically derived between
the AP and phone. The EAP username and password that are used for authentication must be entered on each
phone.
Authenticated key management supports WPA/WPA2-PSK and WPA/WPA2/802.1x+WEP utilizing LEAP
for the EAP type. CCKM can optionally be used with WPA/WPA2/802.1x+WEP mode.

Encryption Methods

To ensure that voice traffic is secure, the Cisco Unified Wireless IP Phone supports WEP, TKIP, and Advanced
Encryption Standards (AES) for encryption. When using these mechanisms for encryption, both the signaling
Skinny Client Control Protocol (SCCP) packets and voice Real-Time Transport Protocol (RTP) packets are
encrypted between the AP and the wireless IP phone.
WEP
Selects the 802.11 Authentication mechanism automatically from the configuration information exhibited
by the AP. Supports WPA/WPA2-PSK or LEAP with 802.1x+WEP or WPA/WPA2.
Authenticated Key Management, on page 41
Encryption Methods, on page 41
Uses information on a RADIUS server to generate unique keys for authentication. Because these keys
are generated at the centralized RADIUS server and are not saved on the phone or AP, WPA provides
more security than WPA Pre-Shared Key (WPA PSK). WPA2 provides more security than WPA.
Uses information on a RADIUS server and a wireless domain server (WDS) to manage and authenticate
keys. The WDS creates a cache of security credentials for CCKM-enabled client devices for fast and
secure reauthentication.
When using WEP in the wireless network, authentication happens at the AP by using open or shared-key
authentication. The WEP key that is set up on the phone must match the WEP key that is configured
at the AP for successful connections. The Cisco Unified Wireless IP Phone supports WEP keys that
use 40-bit encryption or a 128-bit encryption and remain static on the phone and AP.
EAP and CCKM authentication can use WEP keys for encryption. The RADIUS server manages the
WEP key and passes a unique key to the AP after authentication for encrypting all voice packets;
consequently, these WEP keys can change with each authentication.
Cisco Unified Wireless IP Phone 7925G, 7925G-EX, and 7926G Administration Guide
Authenticated Key Management
41