Temporal Key Integrity Protocol

TKIP (Temporal Key Integrity Protocol) was the encryption method introduced with WPA to address WEP's catastrophic security flaws while maintaining compatibility with existing 802.11 hardware. It represents a clever engineering solution to fix a broken protocol without requiring hardware replacement.

Design Goals and Constraints

Primary Objectives

• Fix WEP's key reuse vulnerabilities
• Work with existing RC4-based hardware
• Provide integrity protection
• Enable dynamic key management

Hardware Limitations

• Had to use RC4 cipher (existing hardware constraint)
• Limited processing power on legacy devices
• Minimal firmware changes required
• Maintain 802.11 frame structure compatibility

TKIP Key Hierarchy

Passphrase (8-63 characters)
    ↓ (PBKDF2 - 4096 iterations)
PMK (Pairwise Master Key) - 256 bits
    ↓ (4-way handshake)
PTK (Pairwise Transient Key) - 512 bits
    ├── KCK (Key Confirmation Key) - 128 bits
    ├── KEK (Key Encryption Key) - 128 bits  
    ├── TK (Temporal Key) - 128 bits
    └── MIC Keys - 128 bits (64 bits each direction)

TKIP Per-Packet Key Generation

The core innovation of TKIP is generating a unique encryption key for every packet:

Input Parameters

• TK (Temporal Key): 128-bit base key from PTK
• TA (Transmitter Address): 48-bit MAC address of sender
• TSC (TKIP Sequence Counter): 48-bit packet counter
• Packet Data: Used in Phase 2 mixing

Two-Phase Key Mixing

Phase 1 Mixing (Computed every 65,536 packets)

Inputs: TK[0-15], TA[0-5], TSC[2-5]
Process:
- Mix temporal key with transmitter address
- Incorporate upper 32 bits of sequence counter
- Produces 80-bit intermediate value (TTAK)
- Cached result used for next 65,536 packets

Phase 2 Mixing (Per packet)

Inputs: TTAK (from Phase 1), TK, TSC[0-1], first 4 bytes of packet
Process:
- Mix Phase 1 result with lower TSC bits
- Include packet-specific data
- Generate final 128-bit WEP key for RC4
- Includes 24-bit IV and 104-bit key

Key Mixing Algorithm Details

Phase 1: Every 2^16 packets
TTAK[0] = TSC[1] | (TSC[0] << 8)
TTAK[1] = TSC[3] | (TSC[2] << 8)  
TTAK[2] = TSC[5] | (TSC[4] << 8)
TTAK[3] = TA[1] | (TA[0] << 8)
TTAK[4] = TA[3] | (TA[2] << 8)
// Plus complex mixing with TK and S-box operations

Phase 2: Per packet
WEPkey[0-2] = TSC[0], TSC[1], (TSC[0] | 0x20)  // IV
// Mix TTAK with remaining TK and packet data for 104-bit key

Michael Message Integrity Code (MIC)

TKIP includes Michael algorithm for integrity protection:

Michael Algorithm

• Designed for software implementation
• Uses only 32-bit operations (hardware friendly)
• Takes 64-bit key + variable-length message
• Produces 64-bit authentication tag

MIC Calculation Process

Inputs: 64-bit MIC key, packet data, addresses
1. Append padding to make message multiple of 4 bytes
2. Process in 32-bit blocks using Michael function
3. Include source/destination addresses
4. Final 64-bit result appended to packet

Michael Function (Core)

michael_block(L, R):
    R ^= rotleft(L, 17)
    L += R
    R ^= ((L & 0xff00ff00) >> 8) | ((L & 0x00ff00ff) << 8)
    L += R
    R ^= rotleft(L, 3)
    L += R
    R ^= rotrright(L, 2)
    L += R
    return L, R

TKIP Sequence Counter (TSC)

Purpose: Prevents replay attacks and provides key diversity

Structure

• 48-bit counter (6 bytes: TSC0, TSC1, TSC2, TSC3, TSC4, TSC5)
• Transmitted in clear as part of IV
• Increments for each transmitted packet
• Receiver maintains expected TSC value

Replay Protection

• Receiver checks TSC is greater than last received
• Packets with old TSC values are dropped
• Prevents attackers from replaying captured packets

TKIP Frame Format

802.11 Header | IV/KeyID | Encrypted Data | MIC | ICV
    24 bytes  |  8 bytes |   variable     | 8B  | 4B

IV/KeyID Field:
TSC0 | WEPSeed1 | TSC1 |  KeyID+ExtIV | TSC2 | TSC3 | TSC4 | TSC5
 1B  |    1B    |  1B  |     1B       |  1B  |  1B  |  1B  |  1B

Field Details

• TSC0, TSC1: Lower 16 bits of sequence counter
• WEPSeed1: First byte of Phase 2 mixed key
• KeyID: Key identifier + Extended IV flag
• TSC2-5: Upper 32 bits of sequence counter
• MIC: 8-byte Michael integrity code
• ICV: 4-byte WEP integrity check (CRC-32)

Security Improvements Over WEP

Key Diversity

• WEP: Same key for all packets
• TKIP: Unique key per packet via mixing

Replay Protection

• WEP: No sequence numbers
• TKIP: 48-bit sequence counter with strict ordering

Integrity Protection

• WEP: CRC-32 (linear, forgeable)
• TKIP: Michael MIC (cryptographically secure)

Key Management

• WEP: Static keys manually configured
• TKIP: Dynamic keys derived from authentication

TKIP Vulnerabilities and Attacks

Beck-Tews Attack (2008)

• Exploits Michael MIC algorithm weaknesses
• Can decrypt 12-15 byte packets (like ARP)
• Requires packet injection capabilities
• Takes 12-15 minutes to execute

Ohigashi-Morii Attack (2009)

• Improved cryptanalysis of TKIP key mixing
• Can recover some temporal key bits
• Practical under specific conditions

MIC Key Recovery

• With sufficient traffic, portions of MIC key recoverable
• Allows forging of packets with valid MIC
• Requires extensive packet capture

Chopchop and Fragmentation Attacks

• Modified WEP attacks still partially effective
• Can decrypt packet content byte-by-byte
• Slower than original WEP attacks but still feasible

Countermeasures and Limitations

MIC Failure Countermeasures

• Two MIC failures within 60 seconds → connection shutdown
• Prevents rapid brute-force attacks on MIC
• Network blocks traffic for 60 seconds after trigger

TSC Management

• Strict sequence counter checking prevents most replay attacks
• Counter must never repeat during key lifetime
• Key renegotiation required if counter space exhausted

Limited Lifetime

• TKIP keys should be refreshed periodically
• WPA mandates rekeying capabilities
• Prevents long-term cryptanalytic attacks

Why TKIP Was Deprecated

Fundamental Design Issues

• Built on RC4 cipher (inherently problematic)
• Complexity of key mixing introduced new attack vectors
• Michael MIC algorithm has theoretical weaknesses
• Performance overhead compared to hardware-accelerated AES

WPA2 Advantages

• AES-CCMP provides stronger encryption
• Hardware acceleration available for AES
• Cleaner protocol design
• Better long-term security properties

Industry Transition

• WPA2 certification required by 2006
• TKIP support dropped from new standards
• 802.11n requires AES-CCMP support
• Modern devices may not support TKIP

TKIP served as a crucial bridging technology, providing significantly improved security over WEP while allowing existing hardware to remain useful. However, its complexity and reliance on RC4 made it inherently vulnerable to sophisticated attacks, leading to its eventual replacement by the more robust AES-CCMP protocol in WPA2.