and a 48-bit packet number. Chapter Eight 8-bit Priority 48-bit MAC address 48-bit Packet number 104-bit Nonce 8-bit 104-bit Nonce 16-bit Dlen 128-bit starting block 128-bit Starting block 128-bit Data block 128-bit Data block 128-bit Data block counter mode encryption Result 1 counter mode counter mode encryption encryption Result 2 Result 3 64-bit MIC 64-bit discard Figure 8-10: MIC Computation Using AES and CBC-MAC Step (2) The nonce is concatenated with an 8-bit flag and a 16-bit Dlen field, which indicates the unpadded length of the plaintext data field, to generate a 128-bit starting block for block chaining, Step (3) The starting block is encrypted using AES in counter mode (Figure 8-8) and the result is XOR'd with the first block of plaintext data from the message, Step (4) The result is encrypted using AES in counter mode and the result is XOR'd with the second block of plaintext data, Step (5) This chaining is repeated until the last plaintext block is XOR'd, Step (6) The higher 64-bits of the 128-bit result are the MIC and the lower 64-bits are discarded. Robust Security Network and AES-CCMP The RSN security protocol, AES-CCMP (or AES counter mode-CBC- MAC protocol) defines how the three elements, AES, counter mode and CBC-MAC are used to protect data in an 802.11i implementation. The encryption of a MAC protocol data unit (MPDU), consisting of a MAC header and a data packet, proceeds as follows (Figure 8-11); Wireless LAN Security Packet number CCMP header GTK ID MAC header CCMP header CBC-MAC Counter mode encryption MAC header CCMP header Ciphertext Figure 8-11: MPDU Encryption Using CCMP Step (1) A CCMP header is constructed from a 48-bit packet number and a 3-bit GTK ID, and inserted into the MPDU, between the MAC header and the data payload. Step (2) A CBC-MAC is computed on this extended MPDU, as described in the previous section, and the resulting MIC is appended to the plaintext data block. Step (3) The resulting, so-called encoded data block (data + MIC) is encrypted using AES in counter mode.