WiFi security: history of insecurities in WEP, WPA and WPA2

Recently I answered a question on security.stackexchange.com regarding security in wireless protocols. The OP wanted to know more about what methods were available to break into a wireless network and how long it would take.

There are several popular types of encryption for wireless networks:

• WEP
• WPA
• WPA2
• WPS

Wired Equivalent Privace (WEP)

Let’s first dive into WEP. WEP was the first algorithm used to secure wireless access points. Unfortunately it was discovered that WEP had some serious flaws. In 2001, 3 researchers working at Berkeley produced a paper named “(In)Security of the WEP algorithm“. They found the following flaws in WEP:

• Passive attacks to decrypt traffic based on statistical analysis.
• Active attack to inject new traffic from unauthorized mobile stations, based on known plaintext.
• Active attacks to decrypt traffic, based on tricking the access point.
• Dictionary-building attack that, after analysis of about a day’s worth of traffic, allows real-time automated decryption of all traffic.

An excerpt from their paper about the technical problems with WEP:

WEP uses the RC4 encryption algorithm, which is known as a stream cipher. A stream cipher operates by expanding a short key into an infinite pseudo-random key stream. The sender XORs the key stream with the plaintext to produce ciphertext. The receiver has a copy of the same key, and uses it to generate identical key stream. XORing the key stream with the ciphertext yields the original plaintext. This mode of operation makes stream ciphers vulnerable to several attacks. If an attacker flips a bit in the ciphertext, then upon decryption, the corresponding bit in the plaintext will be flipped. Also, if an eavesdropper intercepts two ciphertexts encrypted with the same key stream, it is possible to obtain the XOR of the two plaintexts. Knowledge of this XOR can enable statistical attacks to recover the plaintexts. The statistical attacks become increasingly practical as more ciphertexts that use the same key stream are known. Once one of the plaintexts becomes known, it is trivial to recover all of the others. WEP has defenses against both of these attacks. To ensure that a packet has not been modified in transit, it uses an Integrity Check (IC) field in the packet. To avoid encrypting two ciphertexts with the same key stream, an Initialization Vector (IV) is used to augment the shared secret key and produce a different RC4 key for each packet. The IV is also included in the packet. However, both of these measures are implemented incorrectly, resulting in poor security. The integrity check field is implemented as a CRC-32 checksum, which is part of the encrypted payload of the packet. However, CRC-32 is linear, which means that it is possible to compute the bit difference of two CRCs based on the bit difference of the messages over which they are taken. In other words, flipping bit n in the message results in a deterministic set of bits in the CRC that must be flipped to produce a correct checksum on the modified message. Because flipping bits carries through after an RC4 decryption, this allows the attacker to flip arbitrary bits in an encrypted message and correctly adjust the checksum so that the resulting message appears valid. The initialization vector in WEP is a 24-bit field, which is sent in the cleartext part of a message. Such a small space of initialization vectors guarantees the reuse of the same key stream. A busy access point, which constantly sends 1500 byte packets at 11Mbps, will exhaust the space of IVs after 1500*8/(11*10^6)*2^24 = ~18000 seconds, or 5 hours. (The amount of time may be even smaller, since many packets are smaller than 1500 bytes.) This allows an attacker to collect two ciphertexts that are encrypted with the same key stream and perform statistical attacks to recover the plaintext. Worse, when the same key is used by all mobile stations, there are even more chances of IV collision. For example, a common wireless card from Lucent resets the IV to 0 each time a card is initialized, and increments the IV by 1 with each packet. This means that two cards inserted at roughly the same time will provide an abundance of IV collisions for an attacker. (Worse still, the 802.11 standard specifies that changing the IV with each packet is optional!)

Another interesting paper was published by aircrack-ng, creators of one of the widest used wireless penetration testing tools, named “Practical attacks against WEP and WPA“.

WiFi Protected Access (WPA)

The second one is WPA. WPA was originally meant as a wrapper to WEP which tackles the insecurities caused by WEP. It was actually never meant as a security standard but just as a quick fix until WPA2 became available.

There are two modes in which it can operate:

• WPA-PSK: Preshared key (password)
• WPA-Enterprise: This requires a RADIUS server and can be combined with an Extensible Authentication Protocol (EAP).

WPA generally uses Temporal Key Integrity Protocol (TKIP). TKIP was designed by the IEEE 802.11i task group and the Wi-Fi Alliance as a solution to replace WEP without requiring the replacement of legacy hardware. This was necessary because the breaking of WEP had left WiFi networks without viable link-layer security, and a solution was required for already deployed hardware. TKIP is not an encryption algorithm, but it’s used to make sure that every data packet is sent with a unique encryption key.

An excerpt from the aircrack-ng paper:

TKIP implements a more sophisticated key mixing function for mixing a session key with an initialization vector for each packet. This prevents all currently known related key attacks because every byte of the per packet key depends on every byte of the session key and the initialization vector. Additionally, a 64 bit Message Integrity Check (MIC) named MICHAEL is included in every packet to prevent attacks on the weak CRC32 integrity protection mechanism known from WEP. To prevent simple replay attacks, a sequence counter (TSC) is used which allows packets only to arrive in order at the receiver.

There are two attacks known against TKIP:

• Beck-Tews attack
• Ohigashi-Morii attack (which is an improvement on the Beck-Tews attack)

Both of these attacks only could decrypt small portions of data, compromising confidentiality. What they can’t give you is access to the network. To give you an idea of how much data can be recovered, a single ARP frame would take around 14-17 minutes to get the plain text. Getting useful information with this type of attack is very improbable (but not impossible) considering the rate of recovery.

The only attack known, besides flaws in firmware of some routers, is bruteforcing the WPA key. Generally the key is generated as follows:

Key = PBKDF2(HMAC−SHA1,passphrase, ssid, 4096, 256)

The algorithm takes the type of HMAC to be used, the passphrase, the ssid as salt, the amount of iterations the password will be hashed and the final length of the generated hash. Considering this algorithm is meant to prevent hashed passwords from being broken it can take a huge amount of time. The only reasonable attack would be to use a dictionary attack (hence it is important to use long passwords containing characters, numbers and letters).

Also note that you need to change your SSID to something very random. Rainbow tables have been generated for the top 1000 used SSIDs. Which can reduce attack time significantly.

WPA also supports AES (which can be used instead of RC4). While AES is more secure than RC4 the biggest problem of WPA is still present, namely the integrity check is still done using TKIP-MIC.

WPA2

WPA2 supports the same modes as WPA, except that it does not use TKIP but CCMP for cryptograhic encapsulation.

CCMP is an enhanced data cryptographic encapsulation mechanism designed for data confidentiality and based upon the Counter Mode with CBC-MAC (CCM) of the AES standard. This is used to replace TKIP for message confidentiality and fixes the security issues which were identified in WPA.

However some access points can still be configured to use both TKIP and CCMP. This was done because otherwise people were required to upgrade their hardware.

Extensions

WiFi Protected Setup (WPS)

WPS, originally Wi-Fi Simple Config, is a computing standard that attempts to allow easy establishment of a secure wireless home network. It allowed easy security for home users but still using the more secure WPA rather than WEP. WPS should never be used as there is a serious design flaw in it. WPS generates ‘by the push of a buton’ a PIN code which can be entered by the user on his computer to gain access to the wireless network. The idea behind this was to increase usability. But this poses a problem: the amount of possibilities is reduced to 10.000.000 which any computer can crunch through quite rapidly, even when using PBKDF2 for key generation.

Extensible Authentication Protocol (EAP)

EAP is used for WPA(2)-Enterprise and is an authentication framework, not a specific authentication mechanism. It provides some common functions and negotiation of authentication methods called EAP methods. There are currently about 40 different methods defined. Some have their own flaws however considering the vast amount of possibilities I suggest looking them up yourself if you are interested in them.