WLAN Authentication and Privacy Infrastructure: Difference between revisions

Revision as of 08:20, 12 August 2014

Latest revision as of 10:25, 19 July 2025

(34 intermediate revisions by 24 users not shown)

Line 1:

{{Short description|Chinese National Standard for Wireless LANs}}

'''WLAN Authentication and Privacy Infrastructure''' ('''WAPI''') is a [[Guobiao|Chinese National Standard]] for [[Wireless LAN]]s (GB 15629.11-2003).

Although it was allegedly designed to operate on top of [[WiFiWi-Fi]], compatibility with the security protocol used by the [[802.11]] wireless networking standard developed by the [[IEEE]] is in dispute. Due to the limited access of the standard (only eleven Chinese companies had access), it was the focus of a [[China–United States relations|U.S.-China–China trade dispute]]. Following this it was submitted to, and rejected by the [[International Organization for Standardization|ISO]]. It was resubmitted to ISO in 2010, but was cancelled as a project inon 21 NovNovember 2011 after being withdrawn by China. <ref>[https://mentor.ieee.org/802.11/dcn/12/11-12-0199-00-0jtc-jacksonville-minutes-jan-2012.doc Minutes of JTC1 Ad Hoc Meeting Thursday PM1, 19 Jan 2012]. IEEE Standards Association.</ref>Part of the reason for withdrawal is thought to be the well documented observations by IEEE representatives that showed WAPI was equivalent to a small subset of IEEE 802.11i based systems.

==How the Standardstandard Worksworks==

{{Main|SMS4SM4 (cipher)}}

WAPI, which was initiated to resolve the existing security loopholes (WEP) in WLAN international standard (ISO/IEC 8802-11), was issued to be Chinese national standard in 2003. WAPI works by having a central Authentication Service Unit (ASU) which is known to both the wireless user and the [[wireless access point|access point]] and which acts as a central authority verifying both.

The WAPI standard (draft JTC1/SC6/ N14619) allows selection of the [[symmetric encryption]] algorithm, either [[Advanced Encryption Standard|AES]] or [[SMS4]], which has been declassified in January 2006 and passed evaluation by independent experts{{who|date=August 2014}}.

==CriticismHistory==

One argument was WAPI standard used [[security through obscurity]]{{citation needed}}, another is that it was designed to limit trade into China{{citation needed}}, as well as requiring foreign companies to provide confidential [[trade secrets]] to Chinese corporations{{citation needed}}.

==History==

===US–China trade dispute===

In late 2003, the Chinese government announced a policy requiring that wireless devices sold in China include WAPI support and foreign companies wanting access to the Chinese market could produce WAPI-compliant products independently or partner with one of 11 Chinese firms to which the standard was disclosed. This issue became a point of trade discussions between the then [[United States Secretary of State]] [[Colin Powell]] and his Chinese government equivalent. China agreed to indefinitely postpone implementation of the policy.<ref>{{cite paperweb |first=Richard |last=Shim |url=http://news.zdnet.com/2100-9584_22-5197087.html |accessdate=2009-07-14 |title=China reaches trade accord, postpones WAPI requirements indefinitely}} {{Dead|archive-url=https://web.archive.org/web/20050407222112/http://news.zdnet.com/2100-9584_22-5197087.html link|archive-date=NovemberApril 7, 2005 2010|boturl-status=H3llBotdead |df=mdy-all }}</ref>

===ISO rejection===

The Chinese Standards Association (SAC: Standardization Administration of the People's Republic of China) subsequently submitted WAPI (ISO/IEC JTC1 N7904) to the [[International Organization for Standardization|ISO]] standards organization for recognition as an international standard, at about the same time as the [[IEEE 802.11i]] standard. After much debate related to both process issues and technical issues, the IEC/[[International Organization for Standardization|ISO]] Secretaries General decided to send the proposals to parallel fast track ballots. In March 2006, the 802.11i proposal was approved and the WAPI proposal was rejected. This result was confirmed at a Ballot Resolution meeting held in June 2006,{{citation during which the SAC delegation walkedneeded|date=August out2014}}.

The result was subject to two appeals by SAC to the ISO/IEC Secretaries General that alleged "unethical" and "amoral" behavior during the balloting process and irregularities during the ballot resolution process{{citation needed|date=August 2014}}. The official Chinese news agency [[Xinhua]] said on May 29, 2006, that appeals were filed in April and May 2006 and, the agency said, alleged that the IEEE was involved in "organizing a conspiracy against the China-developed WAPI, insulting China and other national bodies, and intimidation and threats."{{Citation needed|date=June 2010}} Xinhua did not make these allegations specific. In July 2006, 802.11i was published as an ISO/IEC standard. WAPI is no longer being considered by ISO/IEC and all appeals have been dismissed.

After the preliminary results were announced in March 2006, various press reports from China suggested that WAPI may still be mandated in China{{citation needed|date=August 2014}}. TBT (Technical Barrier to Trade) declarations to the WTO in January 2006 and a statement in June 2006 to ISO/IEC JTC1/SC6, in which SAC said they would not respect the status of 802.11i as an international standard, seemed to support this possibility{{citation needed|date=August 2014}}. However, as of early 2007, the only official Chinese policy related to WAPI is a "government preference" for WAPI in government and government-funded systems. It is unclear how strongly this preference has been enforced, and it seems to have had little effect on the non-government market.<ref name="Fletcher">{{cite paperweb |title=Years on, China Pushes WAPI in Mobile Phones |url=http://www.cio.com/article/492084/Years_on_China_Pushes_WAPI_in_Mobile_Phones |accessdate=2009-07-14 |first=Owen |last=Fletcher}}</ref>

===ISO resubmission===

In 2009, the China NB was encouraged by SC6 to resubmit WAPI to SC6.<ref>{{cite paperweb |title=Made-in-China WAPI standard resubmitted for global use |url=http://en.apa.az/news.php?id=104668 |accessdate=2009-07-14}}</ref> It was allocated the standard number ISO/IEC 20011 after passing the first stage of balloting. Positive votes and commitments to participate in the standardisation process were received from China, Korea, Czech Republic, Switzerland and Kenya. Negative votes were received from the US and the UK{{citation needed|date=August 2014}}. The US and the IEEE 802.11 Working Group provided numerous detailed comments rebutting the case for standardisation made by the China NB in the New Project proposal.

The required comment resolution on the ballot only started in June 2011, with the US, UK, China, Korea and Switzerland NBs and the IEEE 802.11 Working Group all participating. The Swiss NB representative admitted during the process that he was a paid consultant to IWNCOMM, the Chinese source of the WAPI technology{{citation needed|date=August 2014}}. The Kenya and Czech NBs did not participate in the comment resolution process or in any other discussions related to WAPI after the close of the ballot in early 2010.

The comment resolution process failed after agreement could not be established on a variety of fundamental issues. For example, the China NB continued to insist that WAPI was justified because 802.11 included WEP, which is known to be broken. On the other side, the US NB and the IEEE 802.11 NB noted that WEP-based security had been deprecated in favour of WPA2-based security in IEEE 802.11-2007, and that no one had ever alleged any issues with WPA2-based security. In addition, the IEEE 802.11 WG noted that the functionality offered by WAPI systems was equivalent to only a small subset of the security offered by WPA2-based systems.

The China NB eventually withdrew WAPI in October 2011 (document JTC1/SC6N15030SC6 N15030) and the project was formally cancelled by SC6 in February 2012. The reasons for the withdrawal are unclear. The Chinese proponents of WAPI from IWNCOMM were clearly very unhappy when the withdrawal was announced. It has been speculated{{by whom|date=August 2014}} that Chinese government authorities ordered the withdrawal on the basis that WAPI had failed to be standardised by ISO/IEC after eight years. In addition, despite mandates for WAPI to be implemented in China in Wi-Fi enabled mobile phones and by the three Chinese service providers, it is very rarely used in practice.

===Chinese cell phone usage===

Mobile phones in China are controlled by [[Ministry of Industry and Information Technology of the People's Republic of China|MIIT]]. MobileThe phones"indefinite comingpostponing" outof inthe ChinaWAPI requirement in 20092003 requiredcaused the MIIT to supportstop the certification of any phones with Wi-Fi capability. In 2009, a requirement for Chinese phones to support WAPI standardif there is any WLAN capability was made, effectively un-banning WLAN hardware from Chinese phones.<ref>[http://www.infzm.com/content/62143 WiFi圈地之战] {{webarchive|url=https://archive.today/20120907191213/http://www.infzm.com/content/62143 |date=2012-09-07 }} - [[南方周末]]</ref><ref name="Fletcher"/> One of the sticking points behind the [[iPhone]] in China was the support of WiFi without the WAPI standard. In the end, it was released without any WLAN at all.<ref>{{cite paperweb |title=Apple Will Strike iPhone Deal In China Three Months Earlier Than Expected, Says Analyst |url=http://www.businessweek.com/technology/ByteOfTheApple/blog/archives/2009/07/apple_will_stri.html |archive-url=https://web.archive.org/web/20090712235526/http://www.businessweek.com/technology/ByteOfTheApple/blog/archives/2009/07/apple_will_stri.html |url-status=dead |archive-date=July 12, 2009 |first=Peter |last=Burrows |accessdate=2009-07-14}}</ref> In the end, it was released without any WLAN at all.

According to China's State Radio Monitoring Center Chinese, in April 2011 regulators approved the frequency ranges used by a new Apple mobile phone with 3G and wireless LAN support including WAPI.<ref>{{cite paperweb |title=Apple Tweaks Wi-Fi in IPhone to Use China Protocol | url=http://www.pcworld.com/article/195524/ |first=Owen |last=Fletcher | date=3 May 2010 |accessdate=2010-05-04}}</ref> [[Dell|Dell Inc's]] Mini 3 phones have also received network access licenses for China.<ref>{{cite paperweb |title=Pictures of New Dell 3G Phone Put on China Regulator Site |url=httphttps://www.pcworld.com/businesscenter/article/194002/pictures_of_new_dell_3g_phone_put_on_china_regulator_site.html |first=Owen |last=Fletcher |date=12 April 2010 |accessdate=2010-05-04}}</ref>

The Chinese government's preference for the WAPI standard in some respects is similar to their preference for the [[TD-SCDMA]] for their [[3G]] network.

== WAPI Alliance ==

A "WAPI Alliance" analogous to the [[Wi-Fi Alliance]] exists in China.<ref>{{cite web |url=http://www.wapia.org.cn/ |title=WAPI产业联盟 |lang=en, zh |website=wapia.org.cn |access-date=March 20, 2023}}</ref>

==See also==

Line 50 ⟶ 51:

==External links==

* Standard texts:

* [http://www.suntzureport.com/wapi/ SunTzu International LLC on WAPI]

** [https://web.archive.org/web/20060824024454/https://committees.standards.org.au/COMMITTEES/I-000/X0001/JTC001-N-7904.pdf ISO/IEC JTC 1JTC1 N7904], 2005

** [http://isotc.iso.org/livelink/livelink?func=ll&objId=8500308&objAction=Open&vernum=1 ISO/IEC JTC1 N9880], 2009

** [http://www.gb688.cn/bzgk/gb/newGbInfo?hcno=74B9DD11287E72408C19C4D3A360D1BD GB 15629.11-2003] (Chinese, DRMed PDF, Free access from Standardization Administration of China)

** [http://www.cnw.com.cn/cnw07/download/Guide_for_WAPI.pdf Guide for WAPI implementors] {{Webarchive|url=https://web.archive.org/web/20190218082500/http://www.cnw.com.cn/cnw07/download/Guide_for_WAPI.pdf |date=2019-02-18 }}, 2006, in Chinese

* [https://web.archive.org/web/20110716163801/http://www.suntzureport.com/wapi/ SunTzu International LLC on WAPI]

* [http://www.chinatechnews.com/index.php?action=show&type=news&id=2639 The Chinese WAPI Delegation has returned from Geneva, where at the headquarters of the International Organization for Standardization it took part in a meeting with a group promoting IEEE 802.11i]

* [http://www.eet.com/news/semi/showArticle.jhtml?articleID=181502994&pgno=1 The International Organization for Standardization (ISO) rejected China's domestic wireless LAN technology to become an international standard]

* [https://committees.standards.org.au/COMMITTEES/I-000/X0001/JTC001-N-7904.pdf ISO/IEC JTC 1 N7904]

* [http://english.people.com.cn/200605/29/eng20060529_269419.html Xinhua May 29, 2006, report on appeals to ISO]

* [http://isotc.iso.org/livelink/livelink?func=ll&objId=8685212&objAction=Open&vernum=1 ISO/IEC JTC1 N14228], 2009 votes

{{Internet access}}

[[Category:Wireless networking standards]]

[[Category:Guobiao standards]]