Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

usenix.org

Post reply on HN
Print view View original

21–30 of 53 posts

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#21

Post by djrogers »

sengork wrote: post #18
mschuster91 wrote: post #9

Earlier quoted context omitted.

This comment should be made the top comment. Thanks for the information. I guess this implies not "only" passive eavesdropping but also network access in environments without a MAC address filter (not that these can't be spoofed regardless)?

Spoofed yes but they're hard to guess in advance without prior knowledge of the device's MAC address.

MAC addresses are broadcast in the clear regularly, so any device doing that without some randomization is ripe for the picking.

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#22

Post by djrogers »

krallja wrote: post #14

Well, if there's one piece of (somewhat) good news around this and https://www.krackattacks.com/ , it's that TLS and VPNs will become even more common. Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

> What's the historical reason we aren't all using TLS to connect to our APs?

Because it’s insanely impractical for home use? Hey, here’s your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don’t forget you need to re-do this every year...

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#23

Post by cjbprime »

madmod wrote: post #20

I understand that the info to answer my question may not be public yet. I would greatly appreciate an an answer by someone who can explain when it is. If an attacker had recorded encrypted WiFi traffic in the past and then performed one of these attacks could they see the traffic? (I know TLS is used for a lot of traffic, but in time that will be broken too.) It seems to me that a patient attacker could gain a lot of…

I expect they could, yes; WPA2 doesn't offer forward secrecy.

But WPA2 never offered much anyway. If you're on mall wifi, you can already see unencrypted traffic for everyone else, because the client keys are derivable from the shared passphrase (which presumably everyone at the mall has been told) and overhearing the four-way handshake when someone joins. And! You can even fake a disconnect message that forces the four-way handshake to happen again, if you weren't around when the client originally joined.

All of which is to say, WPA2 in passphrase (PSK) mode never actually provided meaningful encryption against other people on the network. :( Someone forgot to tell the protocol designers that Diffie-Hellman exists. Using Diffie-Hellman would achieve both removing the exploit where you observe the four-way handshake, and providing for forward secrecy too.

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#24

Post by [deleted] »

djrogers wrote: post #22
krallja wrote: post #14

Well, if there's one piece of (somewhat) good news around this and https://www.krackattacks.com/ , it's that TLS and VPNs will become even more common. Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

> What's the historical reason we aren't all using TLS to connect to our APs? Because it’s insanely impractical for home use? Hey, here’s your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don’t forget you need to re-do this every year...

[deleted]

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#25

Post by tony101 »

djrogers wrote: post #22
krallja wrote: post #14

Well, if there's one piece of (somewhat) good news around this and https://www.krackattacks.com/ , it's that TLS and VPNs will become even more common. Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

> What's the historical reason we aren't all using TLS to connect to our APs? Because it’s insanely impractical for home use? Hey, here’s your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don’t forget you need to re-do this every year...

I'm thinking of a mechanism where the router obtains a trusted cert automatically, like Plex does (https://blog.filippo.io/how-plex-is-doing-https-for-all-its-...), and then asks users to authenticate by password over TLS before allowing access to network resources.

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#26

Post by [deleted] »

evgen wrote: post #6
evgen wrote: post #2

WPA2 is toast. Ref to the CVEs that will make a lot of network admins hate Monday: https://twitter.com/nick_lowe/status/919527451570638848 And some background: https://eprint.iacr.org/2016/475.pdf

Also worth nothing that the attack in the OP is on TKIP, but the KRACK attack that will be revealed tomorrow is based upon problems with the RNG (the example RNG, which apparently everyone used, is trivial to break and the protocol is also kind enough to provide you with a huge chunk of the entropy used in seeding the RNG. D'oh!)

[deleted]

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#27

Post by gruez »

tony101 wrote: post #25
djrogers wrote: post #22

Earlier quoted context omitted.

> What's the historical reason we aren't all using TLS to connect to our APs? Because it’s insanely impractical for home use? Hey, here’s your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don’t forget you need to re-do this every year...

I'm thinking of a mechanism where the router obtains a trusted cert automatically, like Plex does ( https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... ), and then asks users to authenticate by password over TLS before allowing access to network resources.

that only works because there's a central registar of plex users. im not sure how this can be done ad-hoc for APs. anyone can choose any ssid, so you'll need a global registar of ssids. The system will inevitably need to charge for registrations, otherwise bad actors would squat short and memorable ssids. a preshared key is much more feasible.

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#28

Post by toast0 »

krallja wrote: post #14

Well, if there's one piece of (somewhat) good news around this and https://www.krackattacks.com/ , it's that TLS and VPNs will become even more common. Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

Ignoring the real concern about certificates, and if tls is appropriate for a packet oriented unreliable transport (maybe dtls, then?) consider what version of openssl (or an embedded tls stack) was available when your access point entered development; is that version considered secure today, does it support any ciphers that are considered good practices or even acceptable today?

Re: Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

#29

Post by throw5427 »

djrogers wrote: post #22
krallja wrote: post #14

Well, if there's one piece of (somewhat) good news around this and https://www.krackattacks.com/ , it's that TLS and VPNs will become even more common. Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

> What's the historical reason we aren't all using TLS to connect to our APs? Because it’s insanely impractical for home use? Hey, here’s your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don’t forget you need to re-do this every year...

Trust keys on first use. Like SSH.

https://www.tedunangst.com/flak/post/moving-to-https

"So how does one verify that the downloaded cert is the original? The same way the CAs do. Perform a DNS lookup, make a web request, trust the result. The addition of HPKP would indicate that people find the CA model untrustworthy, solving the problem with trust on first use key continuity. Why not cut out the middle man? Protesting the CAs is admittedly pretty futile, but if I can’t do it, who can?"

Post reply on HN