Dell PowerConnect W-Series FIPS Manual

Also see for PowerConnect W-AP105: Manual Installation guide Specifications Specifications Specifications

Dell PowerConnect W-Series FIPS Manual Manual pdf 33 page image

334.1.2 User AuthenticationAuthentication for the User role depends on the module configuration. When the module is configured as aRemote Mesh Portal FIPS mode and Remote Mesh Point FIPS mode, the User role is authenticated via theWPA2 pre-shared key. When the module is configured as a Remote AP FIPS mode and CPSec protectedAP FIPS mode, the User role is authenticated via the same IKEv1/IKEv2 pre-shared key/RSA certificatethat is used by the Crypto Officer4.1.3 Wireless Client AuthenticationThe wireless client role defined in each of FIPS approved modes authenticates to the module via WPA2.Please notice that WEP and/or Open System configurations are not permitted in FIPS mode. In advancedRemote AP configuration, when Remote AP cannot communicate with the controller, the wireless clientrole authenticates to the module via WPA2-PSK only.4.1.4 Strength of Authentication MechanismsThe following table describes the relative strength of each supported authentication mechanism.AuthenticationMechanismMechanism StrengthIKEv1/IKEv2shared secret (COrole)For IKEv1/IKEv2, there are a 95^8 (=6.63 x 10^15) possible pre-shared keys.In order to test the guessed key, the attacker must complete an IKEv1/IKEv2aggressive mode exchange with the module. IKEv1/IKEv2 aggressive modeconsists of a 3 packet exchange, but for simplicity, let’s ignore the finalpacket sent from the AP to the attacker.An IKEv1/IKEv2 aggressive mode initiator packet with a single transform,using Diffie-Hellman group 2, and having an eight character group name hasan IKEv1/IKEv2 packet size of 256 bytes. Adding the eight byte UDP headerand 20 byte IP header gives a total size of 284 bytes (2272 bits).The response packet is very similar in size, except that it also contains theHASH_R payload (an additional 16 bytes), so the total size of the secondpacket is 300 bytes (2400 bits).Assuming a link speed of 1Gbits/sec (this is the maximum rate supported bythe module), this gives a maximum idealized guessing rate of 60,000,000,000/ 4,672 = 12,842,466 guesses per minute. This means the odds of guessing acorrect key in one minute is less than 12,842,466/(6.63x10^15) = 1.94 x 10^-9, which is much less than 1 in 10^5.