China to adopt own Wi-Fi security standard

Chinese government agencies are prohibiting the import, manufacture and sale of Wi-Fi gear that does not use China's new security specification, which is incompatible with standards technology industry groups developed.

The 1 December deadline for all Wi-Fi gear makers to start using the Wired Authentication and Privacy Infrastructure (WAPI) specification was set by the Standardisation Administration of China, which manages standards in various industries in China. Support for WAPI is not included in current or upcoming security specifications, such as Wi-Fi Protected Access or 802.11i, developed and enforced by industry groups the Institute of Electrical and Electronics Engineers and the Wi-Fi Alliance. WAPI is to be used with Wi-Fi standards in the 2.4GHz radio band, according to a notice from the Standardization Administration of China.

WAPI adds yet another security specification that companies will have to consider as they begin installing Wi-Fi networks, adding further confusion to the market, according to security experts. By prohibiting gear that does not use WAPI, the Chinese government is throwing an obstacle in the way of manufacturers looking to enter the Chinese market, they say.

In the third quarter, the Asia Pacific region had the second largest market share for sales of Wi-Fi gear worldwide, at 18 per cent. North America was number one, with more than 60 per cent. China was one of the top three countries in the Asia Pacific region, according to research firm Synergy Research Group.

Representatives from the Wi-Fi Alliance have been in contact with multiple agencies from the Chinese government, and they are in the early stages of discussions to understand the specification and how the Chinese government plans to enforce it, according to Dennis Eaton, chairman of the Wi-Fi Alliance.

"It would be unfortunate if we are not able to resolve this so that the China standard and others in the world can't coexist," said Eaton. "Wi-Fi vendors may have to use special requirements for products that sell into China."

The IEEE and the Wi-Fi Alliance have not been briefed on WAPI and what it includes, but it is clear, according to Eaton, that it does not use Advanced Encryption Standard (AES), a key encryption component for wireless networks.

Eaton added that he is not aware of any other countries that plan to use WAPI.

The US government and tech companies have been lobbying China to change its decision about the use of WAPI. There are concerns that China will push it as an international standard, according to sources.

However, manufacturers can use a loophole until June of next year. According to the notice from the Standardisation Administration of China, products imported into or manufactured in China for domestic use before 1 December have until June to support WAPI. The same holds true for contracts signed before 1 December for future devices. Products exported from China do not have to use WAPI.

Intel representatives said notebooks using their Centrino technology fit the requirements for the grace period.

"Intel meets the conditions specified within the notice and because of this products with Centrino can continue to be shipped until June," according to an Intel statement. "We're working with the tech industry and authorities in China to better understand the requirements of the new standard for the post-transition period."

Shipment volumes for Dell grew 59 per cent this year compared to last, and the company expects to offer products compatible with WAPI when the grace period ends, according to Dell representative Bruce Anderson.

"We don't expect any disruption of shipment to our Chinese customers," Anderson said.

Richard Shim writes for CNET News.com