George Stefanick - CWSP Journey, (Chapter 5 – RSN POST#2) - 7/4/2010
RSN stands for (Robust Security Network) which was defined in the 802.11i - 2004 standard. This was later rolled under the 802.11-2007 standard (clause 8). The purpose of RSN is to provide stronger encryption and authentication methods.
RSNA stands for (Robust Security Network Association). RSNA requires (2) 802.11 stations to establish procedures to authenticate and associate with each other as well as create dynamic encryption keys through the 4-way handshake. *Note an access point is also a referenced as a station* The 802.11-2007 standard defines two classes of security methods pre-RSNA and RSNA. RSNA security methods use either TKIP/RC4 or CCMP/AES. This leads me to believe that WPA/TKIP is a RSNA as well. Although not under the RSNIE.
RSNIE stands for (Robust Security Network Information Element). RSNIE is the information element found in certain management frames. The purpose of this information element is to show station compatibilities. RSNIE can identify encryption capabilities and authentication type (802.1X/EAP) and (PSK)
NOTE: There are ONLY 4 types of 802.11 frames that contain the RSN Information Element (RSNIE). Remember (2) of these packets come from the (BSS) access point and (2) of them come from the station. The following FRAMES contain the RSNIE (RSN INFORMATION ELEMENT) when WPA2 / 802.11i is enabled on the BSS.
ACCESS POINT (BSS): BEACON and PROBE RESPONSE frames
CLIENT (Station) : ASSOCIATION RESPONSE and REASSOCIATION RESPONSE frames
Pre-RSN stands for (Pre-Robust Security Network). A pre-RSN uses static or dynamic WEP keys. Anything WEP is considered Pre-RSN.
TSN stands for (Transition Security Network). TSN supports both RSN and pre-RSN legacy authentication and encryption on the same BSS. Example – Think of WEP with WPA and/or WPA2 enabled on the same BSS. Pre-RSN + RSN = TSN
Below is the RSNIE
RSNIE is enabled when you choose WPA2 (personal (PSK) or enterprise(802.1X/EAP))
Example #1 WPA/TKIP
Note WPA / TKIP is enabled on this BSS. The WPA information element is populated as you can see. Notice you won’t see an RSNIE.
Example#2 WPA/AES
Note WPA / AES is enabled on this BSS. The WPA information element is populated. Notice you won’t see an RSNIE even though AES is enable. This is because RSN is WPA2 only.
Example#3 WPA2/TKIP
WPA2 / TKIP is enabled on this BSS. The RSN information element is populated. Note you don’t see the WPA information element, because WPA is not selected.
Example#4 – WPA2/AES
Note WPA2 / AES is enabled on this BSS. The RSN information element is populated. Note you don’t see the WPA information element, because WPA is not selected.
Example#5 TSN (Transition Security Network) WEP , WPA/WPA2 (TKIP/AES)
This is an example of a single BSS allowing pre-RSN (WEP) and RSN clients. This becomes beneficial when you want to migrate from WEP to a more secure wireless network such as WPA2.
