ISO/IEC 8802-11:2005/DAmd 7

Specifications for Enhanced Security -- WLAN Authentication and Privacy Infrastructure (WAPI)

Caractéristiques pour la sécurité améliorée -- Authentification de WLAN et infrastructure privée (WAPI)

Standards Content (sample)

DRAFT AMENDMENT ISO/IEC DIS 8802-11/Amd.7
Attributed to ISO/IEC JTC 1 by the Central Secretariat (see page iii)
Voting begins on Voting terminates on
2005-10-07 2006-03-07

INTERNATIONAL ORGANIZATION FOR STANDARDIZATION • МЕЖДУНАРОДНАЯ ОРГАНИЗАЦИЯ ПО СТАНДАРТИЗАЦИИ • ORGANISATION INTERNATIONALE DE NORMALISATION

INTERNATIONAL ELECTROTECHNICAL COMMISSION • МЕЖДУНАРОДНАЯ ЭЛЕКТРОТЕХНИЧЕСКАЯ КОММИСИЯ • COMMISSION ÉLECTROTECHNIQUE INTERNATIONALE

FAST-TRACK PROCEDURE
Information technology — Telecommunications and information
exchange between systems — Local and metropolitan area
networks — Specific requirements —
Part 11:
Wireless LAN Medium Access Control (MAC) and Physical
Layer (PHY) specifications
AMENDMENT 7: Specifications for Enhanced Security — WLAN
Authentication and Privacy Infrastructure (WAPI)

Technologies de l'information — Télécommunications et échange d'information entre systèmes — Réseaux

locaux et métropolitains — Exigences spécifiques —

Partie 11: Spécifications pour le contrôle d'accès au support et la couche physique

AMENDEMENT 7: Caractéristiques pour la sécurité améliorée — Authentification de WLAN et infrastructure

privée (WAPI)
ICS 35.110

In accordance with the provisions of Council Resolution 21/1986 this DIS is circulated in the

English language only.

Conformément aux dispositions de la Résolution du Conseil 21/1986, ce DIS est distribué en

version anglaise seulement.

THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE

REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH.

IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES,

DRAFT INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME

STANDARDS TO WHICH REFERENCE MAY BE MADE IN NATIONAL REGULATIONS.
International Organization for Standardization, 2005
International Electrotechnical Commission, 2005
---------------------- Page: 1 ----------------------
ISO/IEC DIS 8802-11/Amd.7
PDF disclaimer

This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but

shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In

downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat

accepts no liability in this area.
Adobe is a trademark of Adobe Systems Incorporated.

Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation

parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In

the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below.

Copyright notice

This ISO document is a Draft International Standard and is copyright-protected by ISO. Except as permitted

under the applicable laws of the user's country, neither this ISO draft nor any extract from it may be

reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic,

photocopying, recording or otherwise, without prior written permission being secured.

Requests for permission to reproduce should be addressed to either ISO at the address below or ISO's

member body in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail [e-mail]
Web www.iso.org
Reproduction may be subject to royalty payments or a licensing agreement.
Violators may be prosecuted.
ii © ISO/IEC 2005 — All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC DIS 8802-11/Amd.7
NOTE FROM ITTF

This draft International Standard is submitted for JTC 1 national body vote under the Fast-Track Procedure.

In accordance with Resolution 30 of the JTC 1 Berlin Plenary 1993, the proposer of this document recommends

assignment of ISO/IEC 8802-11 to JTC 1/SC 6.
“FAST-TRACK” PROCEDURE

1 Any P-member and any Category A liaison organization of ISO/IEC JTC 1 may propose that an existing

standard from any source be submitted directly for vote as a DIS. The criteria for proposing an existing

standard for the fast-track procedure are a matter for each proposer to decide.

2 The proposal shall be received by the ITTF which will take the following actions.

2.1 To settle the copyright and/or trade mark situation with the proposer, so that the proposed text can be

freely copied and distributed within JTC 1 without restriction.

2.2 To assess in consultation with the JTC 1 secretariat which SC is competent for the subject covered by

the proposed standard and to ascertain that there is no evident contradiction with other International

Standards.

2.3 To distribute the text of the proposed standard as a DIS. In case of particularly bulky documents the ITTF

may demand the necessary number of copies from the proposer.

3 The period for combined DIS voting shall be six months. In order to be accepted the DIS must be

supported by 75 % of the votes cast (abstention is not counted as a vote) and by two-thirds of the P-members

voting of JTC 1.

4 At the end of the voting period, the comments received, whether editorial only or technical, will be dealt

with by a working group appointed by the secretariat of the relevant SC.

5 If, after the deliberations of this WG, the requirements of 3 above are met, the amended text shall be sent

to the ITTF by the secretariat of the relevant SC for publication as an International Standard.

If it is impossible to agree to a text meeting the above requirements, the proposal has failed and the procedure

is terminated.

In either case the WG shall prepare a full report which will be circulated by the ITTF.

6 If the proposed standard is accepted and published, its maintenance will be handled by JTC 1.

© ISO/IEC 2005 — All rights reserved iii
---------------------- Page: 3 ----------------------
Contents
2 Normative references……………………………………………………………………………………1
3 Definitions……………………………………………………………………………………2
4 Abbreviations and acronyms……………………………………………………………………3
5 General description……………………………………………………………………………4
5.3 Logical service interfaces………………………………………………………………………4
5.3.1 SS………………………………………………………………………………………5
5.4 Overview of the services………………………………………………………………………5
5.4.3 Access and confidentiality control services………………………………………………5
5.4.3.1 AuthenticationLinkverification…………………………………………………5
5.4.3.2 Deauthentication Delinkverification………………………………………………7
5.4.3.3 Privacy……………………………………………………………………………7
5.4.3.4 Authentication…………………………………………………………………8
5.7.5 Privacy……………………………………………………………………………………9
5.7.6 Authentication Linkverification…………………………………………………………9
5.7.7 Deauthentication Delinkverification……………………………………………………11
5.8 Reference model…………………………………………………………………………………11
5.9 Establishing the security association……………………………………………12
5.9.1 Infrastructure mode……………………………………………………………………12
5.9.2 IBSS mode…………………………………………………………………………12
6 MAC service definition……………………………………………………………………………13
6.1 Overview of MAC services……………………………………………………………………13
6.1.2 Security services…………………………………………………………………………13
7 Frame formats……………………………………………………………………………………14
7.1 MAC frame formats……………………………………………………………………………14
7.1.3 Frame fields………………………………………………………………………………14
7.1.3.1 Frame Control field……………………………………………………………14
7.1.3.1.2 Type and Subtype fields……………………………………………15
7.1.3.1.9 WEPProtected Frame field………………………………………15
7.2 Format of individual frame types………………………………………………………………15
7.2.2 Data frames………………………………………………………………………………15
7.2.3 Management frames………………………………………………………………………15
7.2.3.1 Beacon frame format…………………………………………………………15
7.2.3.4 Association Request frame format……………………………………………15
7.2.3.6 Reassociation Request frame format…………………………………………16
7.2.3.9 Probe Response frame format………………………………………………16
7.2.3.10 Authentication Linkverification frame format………………………………16
7.2.3.11 Deauthentication Delinkverification…………………………………………17
---------------------- Page: 4 ----------------------
7.3 Management frame body components…………………………………………………………17
7.3.1 Fixed fields……………………………………………………………………………17
7.3.1.1 Authentication Linkverification Algorithm Number field……………………17
7.3.1.2 Authentication Linkverification Transaction Sequence Number field…………18
7.3.1.4 Capability Information field……………………………………………………18
7.3.1.7 Reason Code field……………………………………………………………19
7.3.1.9 Status Code field………………………………………………………………19
7.3.2 Information element…………………………………………………………………………20
7.3.2.25 WAPI information element………………………………………………………21
7.3.2.25.1 Authentication and Key Management Suite………………………22
7.3.2.25.2 Unicast and Multicast Cipher Suites………………………………23
8 Security …………………………………………………………………………………………………23
8.1 WAI authentication and key management……………………………………………………23
8.1.1 The structure of the authentication system……………………………………………24
8.1.1.1 Systems and Ports……………………………………………………………24
8.1.1.2 Controlled and Uncontrolled access…………………………………………25
8.1.2 WAPI security association management………………………………………………27
8.1.2.1 WAPI security association definitions………………………………………27
8.1.2.2 Selection of WAPI security policy……………………………………………30
8.1.3 Certificate………………………………………………………………………………31
8.1.4 WAI protocol……………………………………………………………………37
8.1.4.1 Format of WAI protocol packet ………………………………………………37
8.1.4.2 Certificate Authentication procedure…………………………………………42
8.1.4.3 Unicast key negotiation procedure……………………………………………49
8.1.4.4 Multicast key / STAKey announcement process……………………………54
8.1.4.5 STAKey establishment procedure……………………………………………57
8.1.4.6 Pre-authentication……………………………………………………………58
8.1.4.7 Cached BKSAs and WAPI key management…………………………………60
8.1.4.8 Rekeying………………………………………………………………………60
8.1.4.9 Timeout processing……………………………………………………………60
8.1.4.10 Key derivation architecture………………………………………………61
8.1.4.11 WAI protocol packet’s fragmentation and defragmentation………………63
8.1.4.12 Port control and data transmission…………………………………………64
8.2 WPI privacy infrastructure………………………………………………………………64
8.2.1 Opertate mode…………………………………………………………………………64
8.2.2 Key……………………………………………………………………………………65
8.2.3 Encapsulation and decapsulation………………………………………………………66
8.2.4 Rules for using data packet serial number PN…………………………………………67
8.3 WAPI Authentication and key management state machine……………………………………68

8.3.1 WAPI ASUE Authentication and key management state machine……………………68

8.3.1.1 ASUE state machine states……………………………………………………70
8.3.1.2 ASUE state machine variables………………………………………………71
8.3.1.3 ASUE state machine procedures………………………………………………71
---------------------- Page: 5 ----------------------
8.3.2 WAPI AE Authentication and key management state machine………………………71
8.3.2.1 AE state machine states……………………………………………………76
8.3.2.2 AE state machine variables……………………………………………………77
8.3.2.3 AE state machine procedures…………………………………………………78
10. Layer management……………………………………………………………………………78
10.3 MLME SAP interface…………………………………………………………………………78
10.3.2 Scan…………………………………………………………………………………78
10.3.2.2 MLME-SCAN.confirm……………………………………………………78
10.3.4 Authenticate Linkverification……………………………………………………78
10.3.4.1 MLME-AUTHENTICATE LinkVerify .request………………………78
10.3.4.2 MLME- AUTHENTICATE LinkVerify.confirm………………………80
10.3.4.3 MLME- AUTHENTICATE LINKVERIFY .indication…………………81
10.3.5 Deauthenticate DELINKVERIFY……………………………………………82
10.3.5.1 MLME- DEAUTHENTICATE DELINKVERIFY. request……………82
10.3.5.2 MLME- DEAUTHENTICATE DELINKVERIFY.confirm……………83
10.3.5.3 MLME- DEAUTHENTICATE DELINKVERIFY. indication…………84
10.3.6 Associate……………………………………………………………………………85
10.3.6.1 MLME-ASSOCIATE.request……………………………………………85
10.3.6.3 MLME-ASSOCIATE.indication…………………………………………86
10.3.7 Reassociate……………………………………………………………………………86
10.3.7.1 MLME-REASSOCIATE.request…………………………………………86
10.3.7.3 MLME-REASSOCIATE.indication……………………………………87
10.3.17 MLME-SETWPIKEYS………………………………………………………………87
10.3.17.1 MLME-SETWPIKEYS.request…………………………………………87
10.3.17.2 MLME-SETWPIKEYS.confirm………………………………………89
10.3.18 MLME-DELETEWPIKEYS…………………………………………………………89
10.3.18.1 MLME-DELETEWPIKEYS.request……………………………………89
10.3.18.2 MLME-DELETEWPIKEYS.confirm…………………………………90
10.3.19 MLME-STAKEYESTABLISHED………………………………………………91
10.3.19.1 MLME-STAKEYESTABLISHED.indication…………………………91
10.3.20 SetProtection………………………………………………………………………91
10.3.20.1 MLME-SETPROTECTION.request……………………………………91
10.3.20.2 MLME-SETPROTECTION.confirm……………………………………93
10.3.21 MLME-PROTECTEDFRAMEDROPPED…………………………………………93
10.3.21.1 MLME- PROTECTEDFRAMEDROPPED.indication…………………93
11 MLME ………………………………………………………………………………………………94
11.3 Association and reassociation…………………………………………………………………94
11.3.1 Linkverification—originating STA……………………………………………………94
11.3.2 Linkverification—destination STA……………………………………………………94
11.3.3 Delinkverification—originating STA…………………………………………………95
11.3.4 Delinkverification—destination STA…………………………………………………95
11.4 Association, reassociation, and disassociation………………………………………………95
iii
---------------------- Page: 6 ----------------------
11.4.1 STA association procedures…………………………………………………………95
11.4.2 AP association procedures…………………………………………………………96
11.4.3 STA reassociation procedures………………………………………………………97
11.4.4 AP reassociation procedures…………………………………………………………97
11.4.5 STA disassociation procedures………………………………………………………98
11.4.6 AP disassociation procedures…………………………………………………………98

Annex A (normative) Protocol Implementation Conformance Statements (PICS) ………………………99

A.4 PICS proforma—ISO/IEC 8802.11,2005 Edition………………………………………99
A.4.4 MAC protocol…………………………………………………………………99
Annex C (normative) Formal description of MAC operation……………………………………………102
Annex D (normative) ASN.1 encoding of the MAC and PHY MIB………………………………………163

Annex H (informative) Reference implementations of the frame authentication algorithm and

the key derivation algorithm and the test vectors…………………………………………………191
H.1 Frame authentication algorithm……………………………………………………191
H.1.1 Reference implementation………………………………………………………191
H.1.2 Test vectors………………………………………………………………………193
H.2 Key derivation algorithm………………………………………………………………194
H.2.1 Reference implementation………………………………………………………194
H.2.2 Test vectors………………………………………………………………………195

Annex I (Informative) The example of WAI parameters and WPI block cryptographic algorithm ………199

I.1 Principle……………………………………………………………………………………199
I.2 Algorithm used in China……………………………………………………………………199
I.3 ECC parameters used in China……………………………………………………………199
---------------------- Page: 7 ----------------------
List of figures

Figure 11—Portion of the ISO/IEC basic reference model covered in this amendment……………11

Figure 11a—The establishment of security association under the basic mode………………………12

Figure 13—Frame Control field………………………………………………………………………14

Figure 24—Authentication Linkverification Algorithm Number fixed field………………………18

Figure 25—Authentication Linkverification Transaction Sequence Number fixed field………………18

Figure 42a—WAPI Information Element format……………………………………………………21
Figure 42b—Pre-authentication……………………………………………………………………22
Figure 42c—Suite selector format……………………………………………………………………22
Figure 42d—Suite selector format……………………………………………………………………23
Figure 43a—Uncontrolled and controlled ports……………………………………………………… 25
Figure 43b—Authentication state on controlled port……………………………………………… 26
Figure 43c—Usage of the controlled and uncontrolled port…………………………………………27
Figure 43d—ASUE, AE and ASE roles………………………………………………………………27
Figure 43e—Format of certificate…………………………………………………………………… 32
Figure 43f—Definition of certificate content……………………………………………………………… 33
Figure 43g—Extension Attribute format………………………………………………………………… 35
Figure 43h—Issue format of the certificate……………………………………………………………… 35
Figure 43i—Digest field……………………………………………………………………………… 36
Figure 43j—Attribute field………………………………………………………………………… 36
Figure 43k—Format of WAPI protocol packet in WAI authentication system…………………37
Figure 43l—FLAG………………………………………………………………………………………38
Figure 43m—Certificate……………………………………………………………………………… 39
Figure 43n—Identity…………………………………………………………………………………… 39
Figure 43o—ADDID………………………………………………………………………………… 40
Figure 43p—Attribute format……………………………………………………………………… 40
Figure 43q—Signature attribute………………………………………………………………………… 40
Figure 43r—Certificate Verification Result………………………………………………………… 41
Figure 43s—Identity List…………………………………………………………………………… 42
Figure 43t—Certificate Authentication procedure………………………………………………… 42

Figure 43u—The format of the Data field of Authentication Activation packet…………………………42

Figure 43v—The fomat of the Data field of access authentication request packet………………………44

Figure 43w—The format of the Data field of Certificate Authentication Request packet……………… 45

Figure 43x—The format of the Data field of Certificate Authentication Response packet……………… 46

Figure 43y—The format of the Data filed of Access Authentication Response packet………………… 48

Figure 43z—Unicast key negotiation procedure………………………………………………………… 50

Figure 43aa—The format of the Data field of Unicast Key Negotiation Request packet……………… 50

Figure 43ab—The format of the Data field of Unicast Key Negotiation Responding packet …………… 51

Figure 43ac—The format of the Data field Unicast Key Negotiation Confirmation packet……………… 53

Figure 43ad—Multicast key / inter-station key announcing procedure……………………………… 54

Figure 43ae—The format of the Data field of Multicast key / STAKey announcement packet………54

---------------------- Page: 8 ----------------------

Figure 43af—The format of the Data field of the multicast key/STAKey response packet…………56

Figure 43ag—The flow chart of the STAKey establishment………………………………………… 57

Figure 43ah—The format of the Data field in the STAKey establishment request packet…… 58

Figure 43ai—The format of the Data field in the pre-authentication start packet…………………… 59

Figure 43aj—BK key derivation architecture……………………………………………………………61
Figure 43ak—Unicast key derivation architecture……………………………………………………… 62
Figure 43al—Multicast / STAKey derivation architecture…………………………………………… 62
Figure 43am—Preshared key derivation architecture………………………………………………… 63
Figure 43an—Operate modes…………………………………………………………………………65
Figure 43ao—WPI’s MPDU encapsulation structure…………………………………………………66
Figure 43ap—Integrity check data……………………………………………………………………67
Figure 43aq—ASUE state machine, Part 1……………………………………………………………69
Figure 43ar—ASUE state machine, Part 2……………………………………………………………70
Figure 43as—AE state machine, Part 1………………………………………………………………73
Figure 43at—AE state machine, Part 2………………………………………………………………74
Figure 43au—AE state machine, Part 3………………………………………………………………74
Figure 43av—AE state machine, Part 4………………………………………………………………75
Figure 43aw—AE state machine, Part 5………………………………………………………………75
---------------------- Page: 9 ----------------------
List of tables
Table 1—Valid type and subtype combinations…………………………………………………… 15
Table 5—Beacon frame body…………………………………………………………………………15
Table 7—Association Request frame body…………………………………………………………16
Table 9—Reassociation Request frame body………………………………………………………16
Table 12—Proble Response frame body………………………………………………………………16
Table 13—Authentication Linkverification frame body……………………………………………17
Table 15—Deauthentication Delinkverification frame body…………………………………………17
Table 18—Reason codes………………………………………………………………………………19
Table 19—Status codes………………………………………………………………………………20
Table 20—Element IDs………………………………………………………………………………21
Table 20f—Authentication and Key Management Suites……………………………………………22
vii
---------------------- Page: 10 ----------------------
Specifications for Enhanced Security

“The editing instructions are shown in bold italic. Four editing instructions are used: change,

delete, insert, and replace. Change is used to make small corrections in existing text or tables. The editing

instruction specifies the location of the change and describes what is being changed either by using strikethrough

(to remove old material) or underscore (to add new material). Delete removes existing material. Insert adds new

material without disturbing the existing material. Insertions may require renumbering. If so, renumbering

instructions are given in the editing instructions. Replace is used to make large changes in existing text,

subclauses, tables, or figures by removing existing material and replacing it with new material. Editorial notes

will not be carried over into future editions.”
---------------------- Page: 11 ----------------------
Specifications for Enhanced Security
2. Normative references
Insert the following references at the appropriate locations in Clause 2:

ANSI X9.62-Public Key Cryptography for the Financial Services Industry: The Elliptic Curve Digital Signature Algorithm

(ECDSA)
FIPS 180-2, Secure Hash Standard (SHS), August 2002.
IETF RFC2104, HMAC: Keyed-Hashing for Message Authentication

ITU-T Recommendation X.509，Information technology - Open Systems Interconnection - The Directory: Public-key and

attribute certificate frameworks

ISO/IEC 15946 Information technology - Security techniques - Cryptographic techniques based on elliptic curves

ISO/IEC 10116: 1997 (2nd edition) Information technology - Security techniques - Modes of operation for an n-bit block

cipher algorithm.
---------------------- Page: 12 ----------------------
Specifications for Enhanced Security
3. Definitions
Delete the definition “3.49 WEP.”

Insert the following definitions in alphabetical order into Clause 3, renumbering as necessary:

3.63 authenticator entity (AE): An entity that provides authentication action for the authentication supplicant

before the supplicant accesses to the network. It resides in any STA.

3.64 authentication and key management (AKM) suite: A set of methods for authentication and key

management.

3.65 authentication service entity (ASE): An entity that provides mutual identity authentication for the AE and

the ASUE. It resides in any ASU.

3.66 authentication service unit (ASU): An important part of WAI authentication framework that is based on

public-key cryptography. It manages the certificates and authenticates the identities of users etc.

3.67 authentication supplicant entity (ASUE): An entity that requires identity authentication through ASU. It

resides in any STA.

3.68 key encryption key (KEK): A key used to encrypt the key data field in the key management protocol.

3.69 message authentication key (MAK): A key used to authenticate data source and check integrity in key

management protocol.

3.70 multicast session key (MSK): A random value used to protect multicast MPDUs sent by the node. It is

derived from the multicast master key.

3.71 message integrity code (MIC): A value generated by using a symmetric key cryptographic algorithm on

the input data. If the input data are changed, a new value cannot be correctly computed without knowledge of the

symmetric key.

3.72 multicast master key (MMK): An auxiliary key used to generate the multicast encryption key and the

multicast integrity check key.

3.73 multicast session key security association (MSKSA): The result of the multicast key announcement

process.

3.74 preshared key (PSK): A static key distributed to the STA. The way of the key distribution is beyond this

specification.
---------------------- Page: 13 ----------------------
Specifications for Enhanced Security

3.75 STAKey: A symmetric key used to protect direct communications between two stations in a BSS.

3.76 STAKey security association (STAKeySA): The result of the STA-to-STA unicast key negotiation

process in a BSS. A STAKeySA includes a STAKey.

3.77 base key (BK): An auxiliary key used to generate the unicast session key. It can be negotiated in the

certificate authentication process or directly derived from PSK.

3.78 base key security association (BKSA): The result of the certificate authentication process or the result

directly derived from PSK.

3.79 unicast session key (USK): A random value that is derived from the base key with a pseudo-random

function. It is composed of four parts: the unicast encryption key, the unicast integrity check key, the message

authentication key and the key encryption key.

3.80 unicast session key security association (USKSA): The result of the unicast key negotiation process.

3.81 WAPI key management: The key management including the unicast key negotiation, the multicast key

announcement and the STAKey announcement.

3.82 WAPI security network: A network with the WAPI security mechanism. It is identified by the WAPI

parameter set in management frame such as the Beacon frame.

3.83 wireless local area network authentication and privacy infrastructure (WAPI): A security scheme that

is stated to provide identity authentication and data confidentiality for WLAN. WAPI comprises WAI (WLAN

Authentication Infrastructure) and WPI (WLAN Privacy Infrastructure).
4. Abbreviations and acronyms
delete the abbreviations “IV,ICV,WEP”.
Insert the following abbreviations in alphabetical order into Clause 4:
ADDID address index
AE authenticator entity
AKM authentication and key management
AKMP authentication and key management protocol
ASE authentication service entity
ASU authentication service unit
ASUE authentication supplicant entity
BK base key
BKID base key identification
BKSA base key security association
---------------------- Page: 14 ----------------------
Specifications for Enhanced Security
ECDH Diffie-Hellman exchange in elliptic curve cryptosystem
KEK key encryption key
MAK message authentication key
MIC message integrity check code
MSK multicast session key
MSKID multicast session key index
MSKSA multicast session key security association
NMK notification master key
OUI organization unique identifier
PSK preshared key
STAKeyID STAKey index
STAKeySA STAKey security association
UCK unicast integrity check key
UEK unicast encryption key
USK unicast session key
USKID unicast session key index
USKSA unicast session key security association
WAI WLAN authentication infrastructure
WAPI WLAN authentication and privacy infrastructure
WPI WLAN privacy infrastructure
5. General description
5.3 Logical service interfaces
Change the text in 5.3 as follow:
The complete set of this part architectural services are as follow:
a) Linkverification
a) b) Authentication
b) c) Association
c) d) Delinkverification
d) e) Disassociation
e) f) Distribution
f) g) Integration
g) h) Privacy
h) i) Reassociation
i) j) MSDU delivery

This set of services is divided into two groups: those that are part of every STA, and those that are part of a DS.

---------------------- Page: 15 ----------------------
Specifications for Enhanced Security
5.3.1 SS
Change the text in 5.3.1 as follow:
The SS is as follow:
a) Linkverification
a)b) Authentication
b)c) Deauthentication Delinkverification
c)d) Privacy
d)e) MSDU delivery
5.4 Overview of the services
Change the first paragraph in 5.4 as follow:

There are nine ten services (Linkverification, Authentication, Association, Delinkverification, Disassociation,

Distribution, Integration, Privacy, Reassociation, and MSDU delivery) specified by IEEE 802.11 this standard.

Six of the services are used to support MSDU delivery between STAs. Three Four of the services are used to

control wireless LAN access and confidentiality.
5.4.3 Access and confidentiality control services
Change the text in 5.4.3 as follow:

Two Three services are required for this standard to provide functionality equivalent to that inherent to wired

LANs. The design of wired LANs assumes the physical attributes of wire. In particular, wired LAN design

assumes the physically closed and controlled nature of wired media. The physically open medium nature of a

wireless LAN violates these assumptions.

Two Three services are provided to bring the wireless LAN functionality in line with wired LAN assumptions;

Linkverification, Authentication and privacy. Linkverification and Authentication is are used instead of the

wired media physical connection. Privacy is used to provide the confidential aspects of closed wired media.

Change 5.4.3.1 as follow:
5.4.3.1 AuthenticationLinkverification

In wired LANs, physical security can be used to prevent unauthenticated access. This is impractical in wireless

LANs due to the essence of wireless medium.

IEEE 802.11 provides the ability to control LAN access via the authentication servic

...