[STDS-802-11-TGBH] IRM Points

[G Smith <gsmith@xxxxxxxxxxxxxxxxxxx>]

IRM Check field.

There seems to be some confusion over the IRM Check field.  It was stated that it exposed 8 or 16 bits of the key.

The IRM Check field is the EX-OR of 8 bits of the key, with the next 8 bits.   

For every bit there are 2 combinations

1 can be 10 or 01

0 can be 11 or 00

Hence for each of the bits there are 2 possibilities.  Hence for the 8 bits there are

2 x 2 x 2 x 2 x 2 x 2 x 2 x 2 = 256 possible combinations, i.e. 2⁸

Hence, 256 possibilities for the 16 bits that make up the check. 

Then there are still 112 more bits to go through.

 

Spoofing and such

The idea was asked that a spoof could simply copy the random MAC address and the Hash into an Association request.  True, no different than copying a MAC address.  But even if the AP “recognized” the STA, the spoof STA still has to associate to do anything, and, as was pointed out, the association (4 way handshake) has nothing to do with the IRMK. 

The scheme could easily be that the “Change” option becomes the norm, and as such its IRMK would be unknown and copying the old MAC and Hash would not work.

 

Anyhow, good questions.

Graham

 

 

 

 

 

 

 

 

---

To unsubscribe from the STDS-802-11-TGBH list, click the following link: https://listserv.ieee.org/cgi-bin/wa?SUBED1=STDS-802-11-TGBH&A=1