Ttdfjt

I work at a place that gives Wi-Fi to all the customers, with a password that is 19 characters long. A customer came in and claimed that because the password is long, it slows down the internet speed. Is there any truth to this claim?

No.

This is because your password is converted to a cryptographic key which is of fixed length (128 bits). For any length of password, the corresponding crypto generated key (CMAC) would be of fixed size. Many other parameters such as the client and server id, large random values provided by client and server are used to calculate this CMAC.

Encryption and decryption uses this fixed length CMAC.

Short version: No, it does not. Your password is turned into a fixed-length 256-bit key (the "PSK" in WPA2-PSK), which is further turned into fixed-length temporary keys during the initial "handshake". These temporary keys are the ones used during the actual encryption, and usually change periodically.

No matter what your password, the underlying keys are fixed-length. Therefore, connection speed is unaffected by the password.

The password and the SSID are boiled down by a key derivation function (PBKDF2 for WPA2-PSK), from which we want 256 bits.

This key, called a PMK (Pairwise Master Key) is always 256 bits regardless of password length.

It is then used (along with nonces aNonce, sNonce and MAC addresses) in a 4-way handshake to generate the 512-bit Pairwise Transient Key (PTK), which is then split into multiple keys:

• 128-bit Temporal Key (TK) - Encrypts data itself


• 128-bit Key Encryption Key (KEK) - Encrypts keys (e.g. GTK) during transfer


• 128-bit Key Confirmation Key (KCK) - Involved in EAPoL MIC (part of authentication)


• 64-bit RX and TX keys, used for message integrity codes (MIC) on data frames

These multiple keys change periodically and are, again, fixed length regardless of the password. Specifically, your data is always encrypted by the Temporal Key (TK) and signed off by the TX/RX keys, which are always 128 bits and 64 bits respectively regardless of password length.

Password -> [PMK -> PTK -> Encryption keys]. Items in brackets are fixed length.

*GTK not discussed. Essentially the same as PTK, but multicast/broadcast, sans KCK KEK.

Password verification process is not linked to the connection speed. So the answer is no, the speed is not affected.

No.

When discussing this it is important to note that there are many links between your device and the server it is connecting to. Each link in that path has its own throughput rate and is limited in a variety of ways - none of which have to do with a password length.

Each physical medium, WiFi, Ethernet, Microwave, Fiber, have data rates associated with them. The devices at each end of the links also have limitations both physical and through the software controlling them. But once again, none of those limitations have anything to do with the length of a password.

Physical conditions are the only other things that can limit link rates. For wireless links, the RF conditions rule. For Fiber, it can depends on the laser, the bending of the fiber, the cleave of the ends, etc. For wires, it depends on the connectors, the cable, etc. And again, the password length has nothing to do with these conditions.

The customer may have been confusing password length with key length. But even then, computers are so fast and the implementations so efficient, users are not going to notice the latency associated with those algorithms.

My company, for example, uses AES-256 to do real-time video encryption and decryption at more than 20Mbps with an end to end latency of less than 60ms. The encryption is a very minor part of that 60ms. The encoding and decoding of the H.264 and H.265 (HVEC) video is by far more computationally intensive than the encryption.