I\'ve been reading up on wireless authentication and shared key authentication s

Question

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds worse.

Basics:

1. The station sends an authentication request to the access point.

2. The access point sends challenge text to the station.

3. The station uses its configured 64-bit or 128-bit default key to encrypt the challenge text, and it sends the encrypted text to the access point.

If someone is monitoring this authentication he will have the text challenge in plain text and its encrypted counterpart. Figuring out the passphrase from here on seems straight forward.

Am I understanding this correctly?

Explanation / Answer

The part of WEP you describe isn't really a major weakness because most encryption algorithms in use today are immune to known-plaintext attacks. Basically, this means that having access to both the encrypted data and the decrypted plaintext will not help you figure out the key in any way - so "figuring out the password from here" would NOT be straightforward. And since the challenge is different every time, an attacker cannot simply replay a previous solution to the router.

The main weakness of WEP is that to encrypt, it XORs the bits of network traffic with a generated keystream. This isn't inherently bad, but the same keystream cannot be used twice with this system - and in WEP, the keystream generation process is flawed. The keystream is generated from a random IV (sent to clients in plaintext) and the network key (the password you type into your computer to connect). The network key is the same every time, of course, so if two packets use the same IV, the keystream will also be the same. With only 16 million possible IVs, an attacker can easily capture two packets that share an IV on a busy network, making it easy to work out the keystream and then the key.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.