China implements new Wi-Fi security standard

[InfoSec News <isn () c4i org>]

http://news.com.com/2100-7351_3-5112832.html

By Richard Shim 
Staff Writer, CNET News.com
December 2, 2003

Chinese government agencies are prohibiting the import, manufacture
and sale of Wi-Fi gear that does not use China's new security
specification, which is incompatible with standards technology
industry groups developed.

The Dec. 1 deadline for all Wi-Fi gear makers to start using the Wired
Authentication and Privacy Infrastructure (WAPI) specification was set
by the Standardization Administration of China, which manages
standards in various industries in China. Support for WAPI is not
included in current or upcoming security specifications, such as Wi-Fi
Protected Access or 802.11i, developed and enforced by industry groups
the Institute of Electrical and Electronics Engineers and the Wi-Fi
Alliance. WAPI is to be used with Wi-Fi standards in the 2.4GHz radio
band, according to a notice from the Standardization Administration of
China.

WAPI adds yet another security specification that companies will have
to consider as they begin installing Wi-Fi networks, adding further
confusion to the market, according to security experts. By prohibiting
gear that does not use WAPI, the Chinese government is throwing an
obstacle in the way of manufacturers looking to enter the Chinese
market, they say.

In the third quarter, the Asia Pacific region had the second largest
market share for sales of Wi-Fi gear worldwide, at 18 percent. North
America was No. 1, with more than 60 percent. China was one of the top
three countries in the Asia Pacific region, according to research firm
Synergy Research Group.

Representatives from the Wi-Fi Alliance have been in contact with
multiple agencies from the Chinese government, and they are in the
early stages of discussions to understand the specification and how
the Chinese government plans to enforce it, according to Dennis Eaton,
chairman of the Wi-Fi Alliance.

"It would be unfortunate if we are not able to resolve this so that
the China standard and others in the world can't coexist," said Eaton.  
"Wi-Fi vendors may have to use special requirements for products that
sell into China."

The IEEE and the Wi-Fi Alliance have not been briefed on WAPI and what
it includes, but it is clear, according to Eaton, that it does not use
Advanced Encryption Standard (AES), a key encryption component for
wireless networks.

Eaton added that he is not aware of any other countries that plan to
use WAPI.

The U.S. government and tech companies have been lobbying China to
change its decision about the use of WAPI. There are concerns that
China will push it as an international standard, according to sources.

However, manufacturers can use a loophole until June of next year.  
According to the notice from the Standardization Administration of
China, products imported into or manufactured in China for domestic
use before Dec. 1 have until June to support WAPI. The same holds true
for contracts signed before Dec. 1 for future devices. Products
exported from China do not have to use WAPI.

Intel representatives said notebooks using their Centrino technology
fit the requirements for the grace period.

"Intel meets the conditions specified within the notice and because of
this products with Centrino can continue to be shipped until June,"  
according to an Intel statement. "We're working with the tech industry
and authorities in China to better understand the requirements of the
new standard for the post-transition period."

Shipment volumes for Dell grew 59 percent this year compared to last,
and the company expects to offer products compatible with WAPI when
the grace period ends, according to Dell representative Bruce
Anderson.

"We don't expect any disruption of shipment to our Chinese customers,"  
Anderson said.



-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.