Hacker News Reader

Comment by eboyjr | Hacker News Reader

Call me paranoid, but my home setup requires a string of 64 hex digits. This is troublesome as some implementations (like the factory setup screen for (old?) versions of Android) cap the input "password" at 63 characters.

View on HN

The 802.11 standard calls for a passphrase length of 63 characters. Android has it right, whatever you have setup with 64 characters is out of spec.

More detail: https://stackoverflow.com/questions/18006390/why-is-the-wpa2...

It's not a passphrase; it's the raw PSK key as 64 hex digits.

Is there any particular reason for this? Even plain case sensitive alphanumeric matches 2^256 bits at around 43 characters. That's should be pretty compatible with even older devices I'd think? Could combine it with some usage of VLANs to segregate different classes of device too, might be extra helpful you have some really legacy stuff you can't do without but that could drag down your network overall.

> 2^256 bits

ITYM 256 bits. :-)

Hah, yeah that written in a rush and went a bit Department of Redundancy Department. Not gonna edit my silliness though, the point was there and I was honestly curious if there was some device out there for which it made a difference. The history is WiFi is so convoluted and implementations so all over the place I'm not sure any level of device weirdness would surprise me at this point, but it could still just be interesting to see exactly how off the rails something could go :)

Seems like an odd choice, why not use a shorter pass with a denser code? I use a rather long (23 character) alphabetic password myself, seems sufficient for my rather uncritical home network.

Just thinking about typing in your PW on a printer makes me shiver.

Mine is really long. My wife almost divorced me over having to put it in some devices with less than desired input mechanisms.

That was what WPS was meant to address. But then everyone left it running 24/7 and a temporary-use tool became a massive backdoor.

So why not shorten your password to 63? Will one character really make that much difference if someone is determined to crack your password? And why are you limited to hex digits? Why not use other symbols and characters as well?

A 256-bit pre-shared key is used in WPA authentication. If you type a password, this key is calculated by applying the PBKDF2 key derivation function to the passphrase, using the SSID as the salt and 4096 iterations of HMAC-SHA1. In my case, I am entering the raw PSK manually, so I can't say for sure that some passphrase exists that map to my PSK. Hex digits make it easier to enter this 256-bit binary value and it is a standard way to enter raw PSKs.

Have you considered use of WPA2 Enterprise? EAP-TLS can totally eliminate PSK and all of its problems without extreme approaches.

Reply on news.ycombinator.com