Extreme Networks Summit WM User Manual page 199

A Message Integrity Check or Code (MIC), an additional 8-byte code that is inserted before the
standard WEP 4-byte Integrity Check Value (ICV). These integrity codes are used to calculate and
compare, between sender and receiver, the value of all bits in a message, which ensures that the
message has not been tampered with.
The encryption portion of WPA v2 is Advanced Encryption Standard (AES). AES includes:
A 128 bit key length, for the WPA2/802.11i implementation of AES
Four stages that make up one round. Each round is iterated 10 times.
A per-packet key mixing function that shares a starting key between devices, and then changes their
encryption key for every packet or after the specified re-key time interval expires.
The Counter-Mode/CBC-MAC Protocol (CCMP), a new mode of operation for a block cipher that
enables a single key to be used for both encryption and authentication. The two underlying modes
employed in CCM include:
Counter mode (CTR) that achieves data encryption
Cipher Block Chaining Message Authentication Code (CBC-MAC) to provide data integrity
The following is an overview of the WPA authentication and encryption process:
Step one - The wireless device client associates with Altitude AP.
Step two - Altitude AP blocks the client's network access while the authentication process is carried
out (the Summit WM Controller sends the authentication request to the RADIUS authentication
server).
Step three - The wireless client provides credentials that are forwarded by the Summit WM
Controller to the authentication server.
Step four - If the wireless device client is not authenticated, the wireless client stays blocked from
network access.
Step five - If the wireless device client is authenticated, the Summit WM Controller distributes
encryption keys to the Altitude AP and the wireless client.
Step six - The wireless device client gains network access via the Altitude AP, sending and receiving
encrypted data. The traffic is controlled with permissions and policy applied by the Summit WM
Controller.
Key Management Options
Wi-Fi Protected Access (WPA v1 and WPA v2) Privacy offers you the following key management
options:
None
Opportunistic Keying
Pre-authentication
Opportunistic Keying & Pre-auth
The following sections explain the key management options.
None
The wireless client device performs a complete 802.1X authentication each time it associates or tries to
connect to an Altitude AP.
Summit WM User Guide, Software Version 5.3
199