An Improved Attack on TKIP

  • Finn M. Halvorsen
  • Olav Haugen
  • Martin Eian
  • Stig F. Mjølsnes
Conference paper

DOI: 10.1007/978-3-642-04766-4_9

Volume 5838 of the book series Lecture Notes in Computer Science (LNCS)
Cite this paper as:
Halvorsen F.M., Haugen O., Eian M., Mjølsnes S.F. (2009) An Improved Attack on TKIP. In: Jøsang A., Maseng T., Knapskog S.J. (eds) Identity and Privacy in the Internet Age. NordSec 2009. Lecture Notes in Computer Science, vol 5838. Springer, Berlin, Heidelberg

Abstract

Beck and Tews described the first practical cryptographic attack on IEEE 802.11i TKIP in November 2008, and this paper continues this line of protocol cryptanalysis. We show that their attack on TKIP can be used to create an ARP poisoning attack and a cryptographic DoS attack. Moreover, we are able to decrypt DHCP ACK packets, which are over 12 times longer than the ARP packet used by Beck and Tews. Our method of analysis recovers 596 bytes of keystream that can be used in new attacks on other control protocol messages.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Finn M. Halvorsen
    • 1
  • Olav Haugen
    • 1
  • Martin Eian
    • 1
  • Stig F. Mjølsnes
    • 1
  1. 1.Dep. of TelematicsNorwegian University of Science and TechnologyTrondheimNorway