[Autogenerated] brute forcing WPS encryption with a
dictionary attack is a blunt approach.
It's also noisy and will only work if the access
points pass phrases in the dictionary.
So let's look at something a little more sophisticated and
see how we might be able to decrypt data.
Even if we can't crack the pass phrase we saw in the previous demo that the
W P A 24 way handshake involves an access point and a client sharing
certain pieces of information to verify that both know the secret or pass
phrase and therefore establishing trust.
They then use that information to generate a key the P.
T.
K.
From the information they hold to encrypt data sent between them.
But what we haven't looked at so far is how that data is encrypted.
In W.
P.
A.
Two encryption.
The pdK is used as a key for the entire session that's
established between the client and the access point.
But WPA two is more secure than web because it uses a
unique key for every packet that sent.
This unique packet key is created by combining the session
key with a packet number also called a nonce that increases
by one for every packet that sent.
The packet key is then fed through a stream cipher to generate a key
stream which is x ord with the plaintext message.
To create the encrypted message.
A header containing the packet number is then appended to the encrypted
data so that the recipient of the data can decrypt it.
The most important thing to remember with a two encryption is that the
packet number or not should never be reused because nonce reuse implies
key stream reuse and as we saw earlier,
if we have the same key stream for two different encrypted packets,
we can start to decrypt them.
We know that for every packet that's generated,
the packet number is increased by one.
But the question now is when is the packet number initialized?
And the answer is when the P.
T K is installed.
When the P T K is installed, the packet number is reset to zero.
So how can we use this to our advantage?
Well, the secret is to find a way to force re use of the packet number Nantz,
which we can do if we can force reinstallation of the pair wise transient key.
There's a number of ways we can do that.
But the original technique proposed by the team that
discovered the so called key reinstallation attack or crack
was a channel based on path attack.
With this technique,
an attacker clones an access point and communicates with the client on one
channel but relays the messages to the legitimate access point on a different
channel sitting between the client and the access point.
The attacker then waits for a four way handshake to start and
relays the first three messages between them.
Alternatively,
if the client has previously connected to the access point
then messages one and two aren't sent.
And the attacker looks out for messages three and four.
The attacker relays message three to the client.
But when the client sends the acknowledgement as message
four it's not related to the access point.
As far as the clients concerned,
the four way handshake is completed successfully.
So the P.
T.
K.
Is installed and the packet number nonces initialized to zero.
But from the access points perspective something's not right.
No acknowledgment has been received.
So message three is re sent by the access point to the client and
the client responds with an acknowledgement.
However because the P.
T.
K.
Has been installed the acknowledgement is encrypted using the P.
T.
K.
And the newly initialized packet number.
Again in accordance with the W.
P.
A standard the client re installs the P.
T.
K.
And of course the packet number nonces again reset to zero.
The client can then start to send encrypted data.
But let's take a look at what information the attacker now has access to.
First we have the unencrypted acknowledgment and the
recent acknowledgment which is encrypted.
These can be X.
Ors to yield the encryption cipher key stream.
Now normally this wouldn't be of any use because the next
packet would have a different packet number Nonce and hence a
different in ciphering key stream.
However because the nonce was re initialized to zero.
When the key was reinstalled,
the encrypted data has the same packet number nonce as
the encrypted acknowledgment packet.
And so the same key stream can be absorbed with the
encrypted data to decrypt it.