Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf]

Post by mysterypie » Mon, Oct 16, 2017, 6:15 AM UTC

cjbprime wrote: post #23

madmod wrote: post #20

I understand that the info to answer my question may not be public yet. I would greatly appreciate an an answer by someone who can explain when it is. If an attacker had recorded encrypted WiFi traffic in the past and then performed one of these attacks could they see the traffic? (I know TLS is used for a lot of traffic, but in time that will be broken too.) It seems to me that a patient attacker could gain a lot of…

I expect they could, yes; WPA2 doesn't offer forward secrecy. But WPA2 never offered much anyway. If you're on mall wifi, you can already see unencrypted traffic for everyone else, because the client keys are derivable from the shared passphrase (which presumably everyone at the mall has been told) and overhearing the four-way handshake when someone joins. And! You can even fake a disconnect message that forces the f…

Post by evgen » Mon, Oct 16, 2017, 6:39 AM UTC

throwaway613834 wrote: post #13

evgen wrote: post #2

WPA2 is toast. Ref to the CVEs that will make a lot of network admins hate Monday: https://twitter.com/nick_lowe/status/919527451570638848 And some background: https://eprint.iacr.org/2016/475.pdf

WPA2 in general, or just WPA2-TKIP?

Post by kakarot » Mon, Oct 16, 2017, 6:43 AM UTC

mysterypie wrote: post #31

cjbprime wrote: post #23

Earlier quoted context omitted.

I expect they could, yes; WPA2 doesn't offer forward secrecy. But WPA2 never offered much anyway. If you're on mall wifi, you can already see unencrypted traffic for everyone else, because the client keys are derivable from the shared passphrase (which presumably everyone at the mall has been told) and overhearing the four-way handshake when someone joins. And! You can even fake a disconnect message that forces the f…

> * If you're on mall wifi, you can already see unencrypted traffic for everyone else* Without contradicting your observation, I want to mention that virtually anything important you do on the Internet these days--from online banking to Google searches to reading Hacker News--is protected by a second independent layer of encryption: HTTPS. I'm not excusing the WPA2 flaws, but I do think that your bank info, web searc…

Post by gsich » Mon, Oct 16, 2017, 6:47 AM UTC

cm2187 wrote: post #32

londons_explore wrote: post #4

"We initialize the random number generator with the system uptime, then use it to make crypto keys" - really?!? "We also publish the system uptime in an unencrypted broadcast message to save you the effort of even bruteforcing it". Does nobody do security reviews on this stuff, or are these weaknesses there deliberately? The line between incompetence and malice really is thin here...

And on a device equipped with a radio, it's not very hard to generate entropy.

Post by azernik » Mon, Oct 16, 2017, 7:37 AM UTC

gsich wrote: post #38

azernik wrote: post #19

Earlier quoted context omitted.

WPA2 Enterprise use a central RADIUS server for authentication, with separate credentials for each user, and a (separately-distributed) certificate for the server. It's just not practical for consumer and small-business setups.

Somewhat true. Setting up a Freeradius is not hard. Problem is that you need another device that is running 24/7.