Wireless Security Protocols

Throughout the previous lessons, one thing alone decided who got through: the medium. If signal strength is above the threshold the client associates, below it the client cannot. What drew the boundary was distance, interference, and the access point’s power; none of it asked who the client was.

This lesson’s question is: if an identity condition is added to the crossing, what happens to the boundary? Wireless security generations do exactly this — they tie association to a second condition alongside the medium. The generations’ security properties, their authentication methods, and the attacks aimed at these mechanisms were measured in the Cybersecurity curriculum’s Network Security course and are not repeated here. What is measured here is something else: what the generation condition does to association and coverage.

Association’s Second Condition

A client’s association with an access point is passing two separate tests. The first is the medium’s, and it was measured in the previous lessons: signal strength has to be above the association threshold. The second is the identity’s: the client has to be able to implement at least one of the generations the access point offers.

The two conditions are joined by and. If the medium is sufficient but the generation is not supported, there is no association; if the generation is supported but the signal is weak, there is again none. This means the boundary narrows a second time. The first narrowing is continuous — signal falls with distance. The second is discrete: the client either supports it or does not, there is no value in between.

This distinction determines the whole measurement. When the medium condition changes, the boundary shifts; when the generation condition changes, the boundary is punctured — a client at the exact center of the cell, receiving the strongest possible signal, can still be left outside.

What a Generation Packages

A generation is not a single setting; it is a bundle that changes together. Four things sit inside the bundle: how the client identifies itself (authentication mode), which cipher suite protects the frames carried, how session keys are derived, and whether management frames get integrity protection.

Authentication mode splits into two classes. In pre-shared key mode everyone who enters the network carries the same credential; the access point knows not who arrived, but that the correct key arrived. In enterprise mode each client has its own credential, and authentication is asked of a separate authentication server; the access point does not make the decision itself, it carries it. The second adds a round trip to association, and if the server is unreachable, association never happens at all.

The access point announces what it offers; the client picks, from the announcement, the generation that fits it.

# taught dump , not executed
# generation numbers, suite names, and field values are fictional

access point announcement
  network name                 : cell-b.example
  offered generation           : 2, 3
  authentication mode          : generation 2 pre-shared key, generation 3 enterprise
  cipher suite                 : generation 2 suite-b, generation 3 suite-c
  management frame protection  : generation 3 required, generation 2 optional

client -> access point
  association request
    selected generation        : 2
    cipher suite                : suite-b

This dump is a taught layout and has not been executed; the measurement’s numbers do not come from here but from the run below.

Why an Old Generation Gets Dropped

Dropping a generation is not a fashion change. A generation is dropped because it could not keep the promise it made. The oldest generations’ promise was: a frame carried over the wireless medium will be as protected as a frame carried over a cable. The promise cracked in two places. The key material was short and was not refreshed often enough from frame to frame, so once enough traffic accumulated, the protection weakened statistically. Second, integrity checking was not tightly bound to the frame’s content; a modified frame was not guaranteed to be noticed.

How these two flaws are exploited is not this course’s subject and is not written here; key recovery, handshake capture, and trial procedures live in the Cybersecurity curriculum’s Network Security course, in an authorized-testing context. The only inference here is: a generation is dropped the moment it cannot keep its promise, and dropping it means tightening the association condition. The cost this lesson measures is exactly that.

Mixed Mode

Deployments that want to keep old clients on the network offer two generations at once. This is called transition mode or mixed mode. The intuition is: the new client picks the new generation, the old client picks the old one, no one is left out.

This is the point where the intuition needs measuring. In mixed mode, the set of clients that can associate is the set for the lowest of the offered generations — because everyone who supports the lowest one gets in. This means coverage, too, is the lowest generation’s coverage. Mixed mode does not add the two generations’ coverage together; it gives you the lower one’s.

The measurement’s assumptions:

• WN51. Forty clients are produced from the shared fiction; distance and interference values are unchanged. The oracle is intent itself: the client inside the thirty-meter cell should receive service.
• WN52. The access point’s power is fixed at 58 throughout the measurement. The only thing this lesson changes is the generation condition; power, radius, and interference are held constant.
• WN53. There are three generations, and they are fictional. Every client has a ceiling: a client with ceiling 3 implements all three generations, one with ceiling 1 implements only the first. Ceilings are produced from a separate seed and are independent of distance.
• WN54. The association condition is and: the medium has to be sufficient, and the client’s ceiling has to reach the lowest of the offered generations.
• WN55. Mixed mode means the offered generation set has more than one member. To be able to associate it is enough for the ceiling to reach the set’s lowest member; once associated, the client uses the highest offered generation its ceiling reaches.
• WN56. The count of generation actually used is taken over associated clients; a client that cannot associate uses no generation and does not enter this count.
• WN57. The set’s resolution is forty clients; the smallest measurable difference is 1/40 = 0.025. No difference smaller than this is claimed.

Measurement

"""Generation selection: its effect on association and coverage.

Part 1 - across four generation regimes: associated, full rate, false admit, false deny.
Part 2 - clients dropped moving from mixed mode to a single generation split two ways.
"""
SEED = 20260811
TIERS = ((34, 6), (28, 4), (22, 2), (18, 1))
POWER = 58
CEILINGS = (1, 1, 1, 2, 2, 2, 2, 3, 3, 3)
REGIMES = (("generation 1 only", (1,)), ("generation 2 only", (2,)),
           ("generation 3 only", (3,)), ("mixed 2+3", (2, 3)))


def generator(seed):
    d = seed % 2147483646 + 1

    def r(n):
        nonlocal d
        d = (d * 48271) % 2147483647
        return d % n
    return r


def gap(events, intent, mechanism):
    d = {"correct_admit": 0, "correct_deny": 0, "false_admit": 0, "false_deny": 0}
    for e in events:
        n, m = intent(e), mechanism(e)
        if n and m:
            d["correct_admit"] += 1
        elif not n and not m:
            d["correct_deny"] += 1
        elif m:
            d["false_admit"] += 1
        else:
            d["false_deny"] += 1
    return d


def clients(count=40, seed=SEED):
    r, pool = generator(seed), []
    for i in range(count):
        pool.append({"no": i + 1, "distance": 5 + r(41), "interference": r(13)})
    return pool


def signal(c, power=52):
    return power - c["distance"] - c["interference"]


def rate_tier(c, power=52):
    for threshold, tier in TIERS:
        if signal(c, power) >= threshold:
            return tier
    return 0


def cell_intent(c, radius=30):
    return c["distance"] <= radius


def medium(c, power=52):
    return rate_tier(c, power) > 0


def capability(pool, seed=SEED + 7):
    r = generator(seed)
    for c in pool:
        c["ceiling"] = CEILINGS[r(10)]
    return pool


def associates(c, offered, power=POWER):
    return medium(c, power) and c["ceiling"] >= min(offered)


def used_generation(c, offered):
    """The highest offered generation the ceiling reaches once associated."""
    return max(g for g in offered if g <= c["ceiling"])


pool = capability(clients())
print(f"clients {len(pool)} | inside cell {sum(cell_intent(c) for c in pool)} | "
      f"ceiling 1 {sum(c['ceiling'] == 1 for c in pool)} | "
      f"ceiling 2 {sum(c['ceiling'] == 2 for c in pool)} | "
      f"ceiling 3 {sum(c['ceiling'] == 3 for c in pool)}")
print()
print(f"{'regime':<18s} {'associated':>10s} {'full rate':>9s} {'false admit':>12s} "
      f"{'false deny':>12s}")
for name, offered in REGIMES:
    d = gap(pool, cell_intent, lambda c, o=offered: associates(c, o))
    full = sum(1 for c in pool if associates(c, offered) and rate_tier(c, POWER) == 6)
    print(f"{name:<18s} {d['correct_admit'] + d['false_admit']:10d} {full:9d} "
          f"{d['false_admit']:12d} {d['false_deny']:12d}")
print()
dropped = [c for c in pool if associates(c, (2, 3)) and not associates(c, (3,))]
print(f"mixed 2+3 -> generation 3 only: dropped {len(dropped)}, "
      f"inside cell {sum(cell_intent(c) for c in dropped)}, "
      f"outside cell {sum(not cell_intent(c) for c in dropped)}")
linked = [c for c in pool if associates(c, (2, 3))]
print("generation actually used in mixed 2+3 regime: " + ", ".join(
    f"generation {g}: {sum(1 for c in linked if used_generation(c, (2, 3)) == g)}"
    for g in (2, 3)))

clients 40 | inside cell 27 | ceiling 1 12 | ceiling 2 17 | ceiling 3 11

regime             associated full rate  false admit   false deny
generation 1 only          31        13            5            1
generation 2 only          22         8            4            9
generation 3 only           9         3            2           20
mixed 2+3                  22         8            4            9

mixed 2+3 -> generation 3 only: dropped 13, inside cell 11, outside cell 2
generation actually used in mixed 2+3 regime: generation 2: 13, generation 3: 9

Two Directions of Raising the Generation

The first row is a check point: because generation 1 stays below everyone’s ceiling, the identity condition eliminates no one, and the table reproduces the shared fiction’s power-58 row exactly — 31 associated, 13 full rate, 5 false admit, 1 false deny. This is the state with no generation condition added.

As the condition tightens, two columns move in opposite directions. False admit falls from 5 to 4, then to 2: some of the clients that stayed outside the cell yet associated drop out because they cannot implement the newer generation. False deny, on the other hand, rises from 1 to 9, then to 20. Against a total of 3 units of leakage gained over three steps stands 19 units of service lost. Both differences sit well above the 0.025 resolution.

This is the second claim being paid a second time on the wireless side. Tightening the generation condition is made as a security decision, but its result is a coverage decision: twenty of the twenty-seven-strong inside-cell population cannot associate at all under the generation 3 regime. An audit that counts only false admit reports this regime as an improvement and never sees the other direction.

The third column carries a separate warning. Of the nine clients associated under the generation 3 regime, only 3 are at the full rate tier. Associating is not the same as working; the generation condition narrows the association gate but never touches rate tiers at all, because what determines the tier is still signal strength.

The last two rows are mixed mode’s measure. All four columns of the mixed 2+3 regime are identical to generation 2 only: 22, 8, 4, 9. Mixed mode ties coverage not to the higher generation but to the lowest offered generation. The cost of closing mixed mode and moving to generation 3 only is 13 clients, and that thirteen splits into two directions: 11 are inside the cell and get added to false deny, 2 are outside and get subtracted from false admit. Saying “13 clients dropped” as a single number would put these two directions on the same scale.

The Generation Actually Used in Mixed Mode

The association condition looks at the set’s lowest member; the generation used looks at its highest. Because the two questions are separate, they are counted separately. The last row gives this: of the 22 clients associated under the mixed regime, 13 run over generation 2, 9 over generation 3. More than half the associated population sits on the lower generation, and this number is the same set as the thirteen clients that would drop when mixed mode is closed — we are counting the same clients as the answer to two different questions.

The importance of this row is: a network “supporting generation 3” does not show that traffic on that network runs under generation 3 protection. If the announcement carries two generations at once, which client uses which is the result of the ceiling distribution and can only be read from association records. The measurement shows this distribution on its own: of the 17 clients with ceiling 2, the 13 that can associate stay on the lower generation; of the 11 clients with ceiling 3, the 9 that can associate move up to the higher one.

The authentication mode’s round trip stands behind this row too. In pre-shared key mode, the decision ends at the access point. In enterprise mode, the access point carries the decision and asks an authentication server; a round trip is added to association, and if the server is unreachable, association never completes at all. In this case, the medium condition being satisfied rescues nothing — signal strength is full, the client is inside, and association still does not happen. This is what it means for the generation condition to “puncture” the boundary.

Surfaces and Narrowings

The surfaces generation selection opens up are not an attack narrative; each is a configuration result. Next to every surface counted stands the setting that narrows it.

First surface — mixed mode’s floor effect. In mixed mode the network’s coverage is the lower generation’s; the protection the lower generation carries is also the protection actually used on the network. In the measurement this shows up as the mixed row coming out identical to the generation 2 row. Narrowing: the two generations are not offered under the same network name; clients that require the lower generation are put on a separate network name and a separate segment, so the floor effect stays confined to that segment instead of the whole network. A second narrowing is closing the lower generation entirely, and its cost has been measured: 13 clients, 11 of them from inside the cell.

Second surface — a shared credential. In pre-shared key mode everyone carries a single credential; a departing client’s access can only be cut by changing the key across the entire network. Narrowing: enterprise mode splits the credential per client, and a single client’s access can be cut without touching the rest of the network. The cost is the round trip added to association and the dependency created on the authentication server.

Third surface — unprotected management frames. The frames that open and close association carry no integrity protection under older generations; there is no mechanism checking these frames’ correctness. Narrowing: management frame protection binds these frames to integrity checking too, and it is mandatory under the higher generation. In the measurement this is obtained only by raising the generation condition; so the cost of this narrowing is, again, the false deny column.

Fourth surface — the invisibility of generation selection. Which generation a client picks depends on the announcement and the client’s ceiling; a network administrator does not get to assume how many clients enter on the lower generation. Narrowing: counting the selected generation in association records — this is the counterpart of the measurement’s ceiling distribution: 12 clients have ceiling 1, 17 have ceiling 2, 11 have ceiling 3.

Summary

• Association is the and of two conditions: the medium condition shifts the boundary, the generation condition punctures it; a client at the cell’s center can be left outside despite a strong signal.
• A generation is not a single setting but a bundle: authentication mode, cipher suite, key derivation, and management frame protection change together.
• As the generation condition tightens, false admit goes 5 → 4 → 2, false deny goes 1 → 9 → 20; three units of leakage gained are paid for with nineteen units of service lost.
• Mixed mode ties coverage to the lowest offered generation; all four of its columns match that generation’s, and the cost of closing mixed mode is 13 clients — 11 from inside the cell, 2 from outside.
• Of the nine clients associated under the generation 3 regime, only three are at the full rate tier; the generation condition narrows the gate, it does not change the tier.

Next Step

Everything measured up to this point stayed inside a single range class: a thirty-meter cell, distances in the tens of meters, a rate that steps down tier by tier. Yet the same intent — “the client inside the boundary receives service” — is also built into a pairing bond that spans a few meters, and into a low-power bond stretching for kilometers. The next lesson measures the same forty clients across three separate range classes: as range grows, where does the rate tier land, where does false deny go, and what does intent’s promise of “service” correspond to in each class?