Two industries, two protocols, and one shape: a secret shared in advance, two nonces, and a session key that both sides compute and neither side sends.
Words you will meet
-
Mutual authentication — each side proves its identity to the other, not just the device to the network.
-
Authentication server — the element that actually performs 802.11 authentication; the access point only relays.
-
WPA (WiFi Protected Access) WiFi Protected Access The WiFi Alliance's replacement for WEP; WPA2 and WPA3 followed. introduced in ch. 8 — WiFi (IEEE 802.11 wireless LAN) IEEE 802.11 wireless LAN Wireless LAN access; a user must be within a few tens of metres of the access point. WiFi is a trade name, not an abbreviation. introduced in ch. 1 Protected Access, in versions 1, 2 and 3.
-
EAP (Extensible Authentication Protocol) Extensible Authentication Protocol The protocol carrying 802.11 authentication messages between device, access point and authentication server. introduced in ch. 8 — the end-to-end message format for the authentication conversation.
-
AKA (Authentication and Key Agreement) Authentication and Key Agreement The 4G/5G mutual authentication and key generation procedure. introduced in ch. 8 — the 4G/5G Authentication and Key Agreement protocol.
-
Nonce nonce Simple A number used exactly once, to prove a reply is fresh rather than a recording. Precise A number that a protocol will use only once in a lifetime. Bob sends a nonce R to Alice, who returns it encrypted with their shared key, which proves the response was created after the nonce was chosen and so is not a playback. introduced in ch. 8 — open in glossary — section 8.4’s once-in-a-lifetime number, used here by both protocols.
-
auth_token — what lets the device check that the network knows the shared secret.
Why this matters
Wireless is where security matters most, for a physical reason: an attacker can sniff frames by putting a receiver anywhere within transmission range of the sender. No cable needs to be tapped and no router needs to be compromised.
This section is also the chapter’s summary in disguise. Nonces for authentication, cryptographic hashing for integrity, derived shared symmetric keys, and AES (Advanced Encryption Standard) Advanced Encryption Standard The current US block cipher: 128-bit blocks, keys of 128, 192 or 256 bits. introduced in ch. 8 throughout. Every one of those was built earlier in this chapter, and here they arrive assembled into two real protocols.
Watch for one thing the earlier sections never needed: the device authenticates the network too.
Why authentication runs both ways
The network’s need to check the device is obvious. The reverse is not, and the book gives the reason plainly.
There are documented cases of rogue base stations — equipment operated by attackers, enticing unsuspecting devices to attach to a network that is not what it claims to be. A device that joins one is exposed to a range of attacks.
So a mobile device should be as careful about which network it joins as the network is about which device it admits. That two-way check is mutual authentication, and it is the first goal of both protocols on this page.
The second goal is encryption. Frames cross a channel anyone in range can sniff and manipulate, so the link-level frames carrying user data must be encrypted. Symmetric keys are used, because encryption and decryption have to run at high speed.
The two handshakes
M and the authentication server already share a secret K_AS-M, typically a password. Steps c and d derive a second key for group communication.
Click any arrow to see what that message says and why it is sent.
Run the WPA2 handshake, then switch. The cast changes and the shape does not: a pre-shared secret, two nonces, and a session key that neither side ever transmits.
Read this diagram as text
- Authentication server / MME sends a. Nonce_AS to Mobile device (M). The authentication server generates a nonce and sends it. This is section 8.4 arriving unchanged: a nonce avoids playback attacks and proves the other side is live.
- Mobile device (M) sends b. Nonce_M + HMAC over Nonce_AS and the shared secret to Authentication server / MME. M generates its own nonce, then derives the session key K_M-AP from: Nonce_AS, Nonce_M, the shared secret K_AS-M, its own MAC address and the server's. It returns its nonce and an HMAC-signed value encoding Nonce_AS and the secret.
- Authentication server / MME sends derive the same K_M-AP independently to Authentication server / MME. The HMAC over the nonce it just sent proves M is live. Being able to compute it with the shared secret proves M is who it claims. The server then runs the identical computation to reach the same session key — which has never crossed the air.
- Authentication server / MME sends session key K_M-AP to Access point / base station. The key is distributed to the access point, which will use it to encrypt and decrypt frames. Note that the access point was only a pass-through for the authentication itself.
- Mobile device (M) sends c, d. group key derivation to Access point / base station. The remaining two steps of the four-way handshake derive a second key, for group communication.
Lifelines, left to right: Mobile device (M) (mobile device), Access point / base station (access point), Authentication server / MME (server), HSS — home network (server).
Run the 802.11 scenario first, then switch to the cellular one. The cast changes and the structure does not.
What step b of the WPA2 handshake actually proves
The mobile device returns two things: its own nonce, and an HMAC (Hashed Message Authentication Code) Hashed Message Authentication Code The most popular MAC standard, running the data and key through the hash function twice. introduced in ch. 8 -signed value encoding the server’s nonce and the shared secret.
That single message settles two separate questions.
Is the device live? Yes — because the value covers Nonce_AS, which the
server generated moments ago. This is section 8.4’s ap4.0, reused
without modification.
Is the device who it claims? Yes — because computing that value required
K_AS-M, the secret shared in advance.
And then the session key K_M-AP is derived, by both sides independently,
from Nonce_AS, Nonce_M, the shared secret, and the two
MAC (Media Access Control) Media Access Control The link-layer address burned into a network interface. Before a host has an IP address it is the only identity it has, which is why DHCP keys on it. Chapter 6 covers it properly.
introduced in ch. 4 addresses. It is never transmitted.
In plain words
Nothing secret ever crosses the air in either protocol.
The two sides already share one secret. They exchange two numbers that are not secret at all, and each performs the same computation on them. Both end up holding the same new key, and an eavesdropper who saw both numbers still has nothing.
Where the two protocols differ
The cellular case adds a complication 802.11 does not have: the device may be roaming, attached to a visited network rather than its home one.
That is why the shared secret sits between the device and the HSS (Home Subscriber Service) Home Subscriber Service The 4G database holding what the home network knows about each subscriber. introduced in ch. 7 in the home network. It is stored on the SIM card at one end, and in the home database at the other. It is also why the visited network’s MME (Mobility Management Entity) Mobility Management Entity The 4G element that authenticates a device, tracks where it is, and sets up its data path. introduced in ch. 7 is described as a middleman.
The MME never learns the secret
Follow the cellular scenario again and watch what the MME actually holds.
It receives xres_HSS — the answer the device is expected to produce — and
auth_token, which it forwards without being able to read. It compares two
values and decides.
It never knows, and never learns, K_HSS-M. A visited network can therefore
authenticate a subscriber it has no secret with, which is precisely what roaming
requires.
For 5G this middleman role shrinks further. The authentication decision moves to the home network: a visited network may still reject an authentication, but it is the home network that accepts it. 5G also supports AKA alongside two additional authentication protocols.
The protocols underneath
The Extensible Authentication Protocol defines the message formats for a simple request/response exchange between the mobile device and the authentication server. It is certified under WPA2.
The authentication conversation runs between the device and the server. The access point in the middle only changes the envelope.
Read all steps as text
- EAP runs end to end — The Extensible Authentication Protocol defines the message formats for a simple request/response exchange between the mobile device and the authentication server. It is certified under WPA2.
- Over the wireless link: EAP over LAN — On the 802.11 hop, EAP messages are encapsulated using EAPoL and sent over the wireless link.
- Beyond the access point: RADIUS over UDP/IP — The access point decapsulates the EAP messages and re-encapsulates them using RADIUS for transmission over UDP/IP to the authentication server. RADIUS is not required by the standard, but it is a de facto standard component.
The authentication conversation itself is EAP, which runs end to end between the device and the authentication server. The access point sits in the middle and changes envelopes: EAPoL over the 802.11 link, then RADIUS over UDP (User Datagram Protocol) User Datagram Protocol A simple transport protocol with no reliability, no flow control and no congestion control. introduced in ch. 1 and IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 onward to the server.
RADIUS is not required by the standard. It is a de facto standard component, and DIAMETER is projected to replace it eventually.
The one the book removed
| WEPthe original | WPA12003 | WPA2AES mandated | WPA3June 2018 | |
|---|---|---|---|---|
| What it added | ||||
| What was wrong with it | ||||
| Covered on this page? |
Cells marked ⓘ have a reason behind them — click to read it.
Read this as the chapter's own warning made concrete: wireless security protocols evolve because researchers and attackers keep finding flaws. Click any cell.
WEP is not covered here, and that is deliberate on both sides.
The book removed it from this edition, saying only that there is universal agreement it contained serious flaws. Once those were found, public-domain exploit software made WEP users as open to attack as users with no security features at all. Readers are pointed at the references and at earlier editions on the companion website.
This site follows that decision rather than reconstructing WEP from outside sources. What is worth carrying forward is not the mechanism but the pattern: wireless security protocols have undergone constant evolution, as researchers and attackers keep discovering flaws. WPA3 exists because an attack was found on WPA2’s four-way handshake that could induce nonce reuse.
A dangling cross-reference in the printed book
Section 8.8.2 opens by suggesting you re-read “Sections 7.4 and 7.7.1” for the 4G/5G architecture.
There is no section 7.7.1. Chapter 7’s §7.7 is Wireless and Mobility: Impact on Higher-Layer Protocols, and it has no subsections at all. The material being pointed at — mobility management in 4G/5G networks — is §7.6.1, and the architecture itself is §7.4.
Verified against the page image. This is the second cross-reference in the book that sends a reader to the wrong place. The first was §7.6’s own opening, recorded in chapter 7’s review.
The mental model
Both protocols answer the same two questions with the same two tools.
Who are you? — a secret shared before the conversation starts, used to compute something only its holder could compute. Are you here now? — a nonce, exactly as in section 8.4.
Everything else is the plumbing that particular industry needs. 802.11 needs an authentication server behind the access point. Cellular needs the home network to answer for a subscriber standing in somebody else’s network.
And in both, the encryption key is derived rather than delivered. It is the one thing that never travels.
Check yourself
Check yourself
0 of 7 answered1.Why must the mobile device authenticate the network, and not only the other way round?
2.In the WPA2 handshake, what does the device's single reply in step b prove?
3.predictAn eavesdropper records both nonces from a WPA2 handshake. What can they do with the session key?
4.In 4G AKA, what does the MME actually learn about the shared secret K_HSS-M?
5.What does auth_token let the mobile device conclude?
6.EAP runs between the device and the authentication server. What does the access point do with it?
7.Why does this edition of the book not cover WEP?
What to remember
-
The device authenticates the network, not just the reverse. Rogue base stations exist and entice devices to attach, so both protocols make the network prove it knows the shared secret before the device commits.
-
The session key is computed independently at both ends and never sent. Two nonces and a pre-shared secret go in; the same key comes out on both sides, and an eavesdropper who saw both nonces has nothing.
-
The visited network authenticates a subscriber whose secret it never sees. The MME compares a response with an expected response supplied by the home network — which is what makes roaming possible at all, and which shrinks further in 5G.