T/WAPIA 010.4-2012 Information technology - Inter-system remote communication and information exchange - Local area networks and metropolitan area networks - Specific requirements - Part 11: Media access control and physical layer specifications for wireless LANs - Supplement 4: User password setting requirements for wireless LANs
T/WAPIA 010.4-2012 Information technology - Inter-system remote communication and information exchange - Local area networks and metropolitan area networks - Specific requirements - Part 11: Media access control and physical layer specifications for wireless LANs - Supplement 4: User password setting requirements for wireless LANs
Basic Information
Scope
Scope: This standard sets requirements for password-related functions such as the WAPI non-default access method (pre-shared key PSK), the wireless LAN access point (AP) management interface, the wireless LAN authentication service unit (ASU) login interface, and the wireless LAN AP controller login interface, etc., so that the implementation of wireless LAN devices, systems, and applications can more effectively resist guessing, brute-force attacks, and dictionary attacks. This standard applies to wireless LAN device manufacturers, system integrators, application service providers, and operating organizations. Main technical content: Since the promulgation of the GB15629.11 series of national standards, the number of products, systems, and applications based on wireless LAN technology has been increasing. To further enhance the security level of wireless LAN products, systems, and applications, many effective security solutions have been proposed. Most of these security solutions are based on the mechanism of pre-shared keys. During the specific operation process, users need to configure and use passwords as trust credentials for identity authentication. The security of user passwords is directly related to the security of the entire wireless LAN system. Once the user passwords are cracked, the foundation of the entire security solution will no longer exist, and security will be impossible to achieve. Device manufacturers have paid more and more attention to such issues during the productization process and proposed many improvement solutions, such as limiting the minimum length of keys and designing specific UI user interfaces to remind users of the security level of the configured keys. However, with the continuous updating of hacking methods and the continuous improvement of computer capabilities, simple requirements such as password length are no longer sufficient to meet the needs of password security. It is necessary to propose comprehensive requirements fo