An Improved Attack on TKIP

  • Finn M. Halvorsen
  • Olav Haugen
  • Martin Eian
  • Stig F. Mjølsnes
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5838)

Abstract

Beck and Tews described the first practical cryptographic attack on IEEE 802.11i TKIP in November 2008, and this paper continues this line of protocol cryptanalysis. We show that their attack on TKIP can be used to create an ARP poisoning attack and a cryptographic DoS attack. Moreover, we are able to decrypt DHCP ACK packets, which are over 12 times longer than the ARP packet used by Beck and Tews. Our method of analysis recovers 596 bytes of keystream that can be used in new attacks on other control protocol messages.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Beck, M., Tews, E.: Practical attacks against WEP and WPA. Cryptology ePrint Archive Report 472, 79–86 (2008)Google Scholar
  2. 2.
    KoreK: chopchop (Experimental WEP attacks) (2004), http://www.netstumbler.org/f50/chopchop-experimental-wep-attacks-12489/
  3. 3.
    IEEE Standard for Information technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements - Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications. IEEE Std 802.11-2007 (Revision of IEEE Std 802.11-1999) (2007)Google Scholar
  4. 4.
    Fluhrer, S., Mantin, I., Shamir, A.: Weaknesses in the key scheduling algorithm. In: Vaudenay, S., Youssef, A.M. (eds.) SAC 2001. LNCS, vol. 2259, pp. 1–24. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  5. 5.
    Stubblefield, A., Ioannidis, J., Rubin, A.D.: A key recovery attack on the 802.11b wired equivalent privacy protocol (WEP). ACM Trans. Inf. Syst. Secur. 7, 319–332 (2004)CrossRefGoogle Scholar
  6. 6.
    Bittau, A., Handley, M., Lackey, J.: The Final Nail in WEP’s Coffin Security and Privacy. In: IEEE Symposium on, pp. 386–400 (2006)Google Scholar
  7. 7.
    Tews, E., Weinmann, R.-P., Pyshkin, A.: Breaking 104 bit WEP in less than 60 seconds. Cryptology ePrint Archive 120 (2007)Google Scholar
  8. 8.
    KoreK.: Next generation of WEP attacks (2004), http://www.netstumbler.org/showpost.php?p=93942&postcount=35

Copyright information

© Springer-Verlag Berlin Heidelberg 2009

Authors and Affiliations

  • Finn M. Halvorsen
    • 1
  • Olav Haugen
    • 1
  • Martin Eian
    • 1
  • Stig F. Mjølsnes
    • 1
  1. 1.Dep. of TelematicsNorwegian University of Science and TechnologyTrondheimNorway

Personalised recommendations