Open System Authentication, Shared Key Authentication, and Deauthentication
. . . .

---

Open System Auth, Shared Key Auth and Deauthentication

These legacy authentication methods were not so much an authentication of user identity, but more of an authentication of capability. Think of these authentication methods as verification between the two devices that they are both valid 802.11 devices.

Open System Authentication

• Provides authentication without performing any type of client verification.
• It is essentially an exchange of hellos between the client and the AP.
• It is considered a null authentication because no exchange or verification of identity takes place between the devices.
• Open System authentication occurs with an exchange of frames between the client and the AP.
• Wired Equivalent Privacy (WEP) security can be used with Open System authentication; however, WEP is used only to encrypt the upper-layer information of data frames and only after the client station is 802.11 authenticated and associated.
• Because of its simplicity, Open System authentication is also used in conjunction with more advanced network security authentication methods such as PSK authentication and 802.1X/ EAP.

Shared Key Authentication

• Shared Key authentication is simply not used anymore
• Shared Key authentication uses WEP when authenticating client stations and requires that a static WEP key be configured on both the station and the AP.
• In addition to WEP being mandatory, authentication will not work if the static WEP keys do not match.
• The authentication process is similar to Open System authentication but includes a challenge and response between the AP and client station.
• Shared Key authentication is a four-way authentication frame exchange:

 

1. The client station sends an authentication request to the AP.
2. The AP sends a cleartext challenge to the client station in an authentication response.
3. The client station then encrypts the cleartext challenge and sends it back to the AP in the body of another authentication request frame.
4. The AP then decrypts the station’s response and compares it to the challenge text. If they match, the AP will respond by sending a fourth and final authentication frame the station, confirming the success. If they do not match, the AP will respond negatively. If the AP cannot decrypt the challenge, it will also respond negatively.

 

• If Shared Key authentication is successful, the same static WEP key that was used during the Shared Key authentication process will also be used to encrypt the 802.11 data frames.
• Although it might seem that Shared Key authentication is a more secure solution than Open System authentication, in reality Shared Key could be the bigger security risk. Anyone who captures the cleartext challenge phrase and then captures the encrypted challenge phrase in the response frame could potentially derive the static WEP key.
• If the static WEP key is compromised, a whole new can of worms has been opened because now all the data frames can be decrypted. Neither of the legacy authentication methods is considered strong enough for enterprise security and WEP is essentially a legacy encryption method that has been cracked.

Deauthentication

• A deauthentication frame is a notification and not a request.
• If a station wants to deauthenticate from an AP, or an AP wants to deauthenticate from stations, either device can send a deauthentication frame.
• Because authentication is a prerequisite for association, a deauthentication frame will automatically cause a disassociation to occur.
• Deauthentication cannot be refused by either party, except when management frame protection (defined in 802.11w) is negotiated and the message integrity check (MIC) fails.

---

Reference:
Coleman, David D.,Westcott, David A. CWNA: Certified Wireless Network Administrator Official Study Guide: Exam CWNA-106 Wiley.