Home WiFi Router with pfSense or m0n0wall?

[RW]

On Wed, 24 Apr 2013 16:16:32 -0400
Michael Powell wrote:

> Alejandro Imass wrote:
> 
> [snip]
> >>> Most consider the answer to use WPA2, which I do use too. Many
> >>> think it is 'virtually' unbreakable, but this really is not true;
> >>> it just takes longer. I've done WPA2 keys in as little as 2-3
> >>> hours before.
> >>
> >> Are you saying that any WPA2 key can be cracked or or you simply
> >> referring to weak keys?
> > 
> > I would also like to specifically if it's for weak keys or are all
> > WPA2 personal keys crackable by brute force. Also is WPA2 Enterprise
> > as weak also. Could anyone expand on how weak is WPA2 and WPA2
> > Enterprise or is this related to weak PSKs only??
> > 
> 
> I'm just a lowly sysadmin and not any kind of crypto expert.  The
> problem is time and horsepower. While a ridiculously easy key of say
> 4 characters that is not salted may be doable on a PC, once you start
> to get to 8-9 characters or more the time it takes begins to get huge
> fast. It's a matter of can you tie up the resource long enough to
> wait it out. 

Right, but if you were to strip-mine the earth's crust and turn all the
silicon into GPU cores you still wouldn't even come close to
brute-forcing AES256 before the sun turns into a red-giant.

If you're saying that WPA is inadequate because weak keys can be
bruteforced then the answer is don't use a weak key. If someone breaks
such a key then that's pilot error, not an inherent weakness in WPA.

Use a key with 100-256 bits of entropy.

> What I do at home is concatenate 2 ham radio call signs of friends
> that I can remember. Then I sha256 that and select from the end
> backwards 15 characters. 

60 bits tops - assuming that there was 60 bit of entropy in the hashed
data. My key is only twice as long, but about
40,000,000,000,000,000,000,000,000,000 times better at resisting a brute
force attack.

>  This won't actually defeat the inherent
> weakness of using a pre- shared key, but it will take longer for a
> simple brute force. You should also throw in additional characters
> from your character set beyond just alpha/numerics.

That's good advice for natural language pass phrases where there is
only  about 1 bit of entropy per character. IMO it's easier to type a
high entropy password using only characters that wont need shifting on
any device i.e. random lower-case letters.