wifi那点事-WPS
欢迎转载，转载时请保留作者链接，尊重原作者：http://blog.csdn.net/ivan_
wifi技术交流群QQ：92953762
目前路由器项目中大部分都有WPS功能，而且实现流程基本一样， 都是根据wifi联盟定的协议实现。WPS功能，特别是PBC在无人机界面配置wifi中显得很方面，因此得到广泛应用。
本人根据开发的经历，拿出来跟大家分享。
一 WPS连接简要介绍：
1． WPS功能有四种连接方式：PIN，PBC（PUSH BUTTON CONFIGURE），USB，NFC；
PIN和PBC连接是目前 WPS设备最常用的；
2． PIN方式
每个WPS设备会有一个PIN来用作设备识别码；
PIN码是个8位数字，最后一位不是随意的数字，是由前面7位数字经过计算得到的一个CheckSum；
在AP上输入WPS Client设备的PIN即可完成连接/在WPS Client设备上输入AP的PIN即可完成连接。
3． PBC方式
在AP或者WPS Client上按下WPS按钮，120秒内在另一设备上按下WPS按钮wifi即可自动完成连接。
最常用的的还是PBC。
二 PBC 连接过程
2.1 当按下AP和WPS client的WPS按键后，蒋触发PBC会话，概述如下：
1、AP发出beacon,WPS client广播扫描ProbeRequest。在Beacon、ProbeRequest、 RrobeResponse中包含了802.11 IE信息，这些信息告诉Client，该设备拥有进行WPS的能力。
2、之后进行Registrar Protocol的第一阶段，主要目的是让双方发现对方支持的特性以及交换公钥。
如果此阶段没有终止WPS过程的话，则进行RegistrarProtocol的第二阶段，其中有三次信息交换(M3,M4,M5,M6,M7,M8) 来完成认证和提供证书。
信息及网络证书通过扩展认证协议（EAP）在空中进行安全交换，该协议是WPA2 使用的认证协议之一。
2.2 具体数据交换过程：
参数意义如下：
• || this symbol means concatenation of parameters to form a message
• Subscripts when used in the context of a cryptographic function such as HMACKey refer to the
key used by that function.
• Mn* is message Mn excluding the HMAC-SHA-256 value.
• Version identifies the type of Registration Protocol message.
• N1 is a 128-bit random number (nonce) specified by the Enrollee.
• N2 is a 128-bit random number (nonce) specified by the Registrar.
• Description contains a human-readable description of the sending device (UUID,
manufacturer, model number, MAC address, etc.) and device capabilities such as supported
algorithms, I/O channels, Registration Protocol role, etc. Description data is also included in
802.11 probe request and probe response messages. Data elements included in the Description
for each message are specified in Section 7.
• PKE and PKR are Diffie-Hellman public keys of the Enrollee and Registrar, respectively. If
support for other cipher suites (such as elliptic curve) is added in the future, a different protocol Version number will be used.
• AuthKey is an authentication key derived from the DiffieHellman secret gABmod p, the nonces N1 and N2, and the Enrollee’s MAC address. If M1 and M2 are both transported over a channel that is not susceptible to man-in-the-middle attack, the Enrollee’s device password may be omitted from the key derivation.
• E-Hash1, E-Hash2 are pre-commitments made by the Enrollee to prove knowledge of the two halves of its own device password.
• R-Hash1, R-Hash2 are pre-commitments made by the Registrar to prove knowledge of the two halves of the Enrollee’s device password.
• ENCKeyWrapKey(...) This notation indicates symmetric encryption of the values in parentheses using the key KeyWrapKey. The encryption algorithm is
AES-CBC per FIPS 197, with PKCS#5v2.0 padding.
• R-S1, R-S2 are secret 128-bit nonces that, together with R-Hash1 and R-Hash2, can be used
by the Enrollee to confirm the Registrar’s knowledge of the first and second half of the Enrollee’s device password, respectively.
• E-S1, E-S2 are secret 128-bit nonces that, together with E-Hash1 and
E-Hash2, can be used by the Registrar to confirm the Enrollee’s knowledge of the first and second half of the Enrollee’s device password, respectively.
• HMACAuthKey(...) This notation indicates an Authenticator attribute that contains a HMAC keyed hash over the values in parentheses and using the key AuthKey. The
keyed hash function is HMAC-SHA-256 per FIPS 180-2 and RFC-2104. To reduce message sizes, only 64 bits of the 256bit HMAC output are included in the Authenticator attribute.
• ConfigData contains WLAN settings and Credentials for the Enrollee. Additional settings for other networks and applications may also be included in ConfigData.
Although ConfigData is shown here as always being encrypted, encryption is only mandatory for keys and key bindings. Encryption is optional for other configuration data. It is the sender’s decision whether or not to encrypt a given part of the ConfigData.
2.3 WPS的核心是数据交换使用了不少加密算法。我们先了解下M1-M8到底做了什么事。
待续……
欢迎转载，转载时请保留作者链接，尊重原作者：http://blog.csdn.net/ivan_
wifi技术交流群QQ：92953762