2.3.3. MAC header extension 2.3.3.1. WEP protocol The WEP protocol adds eight bytes to the MAC header (Figure 2.15): - WEP header is composed of initialization vector (IV) and KeyID fields: - IV field, coded on three bytes, is the initialization vector used to generate the pseudo-random sequence of the RC4 algorithm; Wi-Fi Integration to the 4G Mobile Network - KeyID field, coded on two bits, enables the selection of a key from among four possible ones; - integrity check value (ICV) field, coded on four bytes, is the result of the calculation of a CRC-32 applied to MAC service data unit (MSDU). The LLC frame constitutes the MSDU data. 4 bytes 4 bytes 4 bytes header header Ciphered part 3 bytes b0 to b5 Reserved b6, b7 KeyID Figure 2.15. Format of WEP encapsulation The 128-bit (or 64-bit) secret is composed of a 104-bit (or 40-bit) WEP key concatenated with the 24-bit IV. The secret determines the start sequence of the pseudo-random sequence of the RC4 algorithm (Figure 2.16). Pseudo-random Secret sequence Concatenation Algorithm exclusive ciphered Concatenation CRC-32 Figure 2.16. WEP processing of the transmission chain Encryption consists of executing an exclusive OR of data, including the MSDU and ICV fields, on the one hand, and the pseudo-random sequence of the RC4 algorithm, on the other. MAC Layer Upon reception of the MAC frame, the following operations are executed (Figure 2.17): - the secret is reconstituted from the WEP key and the IV field; - the pseudo-random sequence is initialized using the secret; - the unscrambled data (MSDU and ICV) are generated by the exclusive OR of the encrypted data and the pseudo-random sequence; - the local calculation of the CRC-32 on the MSDU data is compared to the ICV field received. If the two values are equal, then the MSDU data integrity check is positive; otherwise, the MSDU data are deleted. Pseudo-random Secret sequence Concatenation Algorithm exclusive Ciphered CRC-32 Figure 2.17. WEP processing of the reception chain 2.3.3.2. TKIP The TKIP reuses the format of