Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

1-32
Introduction
ProCurve Wireless Edge Services xl Module
WEP did not succeed at creating per-frame keys for several reasons that are
beyond the scope of this overview to describe. You simply need to know that,
in an enterprise setting, you should always use the more secure WPA or WPA2.
WPA requires TKIP, a protocol that implements key mixing to successfully
create per-frame keys. In addition to backward-compatibility support for TKIP,
WPA2 requires support for Counter Mode with Cipher Block Chaining Mes-
sage Authentication Code Protocol (CCMP) with AES—an extremely secure
block cipher.
As was suggested throughout “Authentication Options for WLANs” on
page 1-24, authentication is an important component of encryption. This is
because 802.1X authentication provides a means for the Wireless Edge Ser-
vices xl Module and the wireless devices to automatically receive an encryp-
tion key specific to their association.
Without 802.1X authentication, all wireless stations must use the same key.
The key also acts as a password: unless the user enters the correct key, the
station cannot successfully encrypt and forward data. For WPA/WPA2, the
additional security provided by TKIP or AES offsets the lesser security of using
a shared, manually configured encryption key. For WEP, however, a static key
provides little real security, particularly in a busy, enterprise environment.