Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal - - PowerPoint PPT Presentation

▶
dragonfly handshake of
SMART_READER_LITE
LIVE PREVIEW

Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal - - PowerPoint PPT Presentation

Jul 28, 2023 194 likes •818 views

Dragonblood : Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal Ronen Real World Crypto, New York, 10 January 2020. Background: Wi-Fi Security 1999: Wired Equivalent Privacy (WEP) Broken in 2001 [FMS01] 2003:

slide-1
SLIDE 1

Mathy Vanhoef and Eyal Ronen Real World Crypto, New York, 10 January 2020.

Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd

slide-2
SLIDE 2

Background: Wi-Fi Security

› 1999: Wired Equivalent Privacy (WEP)

Broken in 2001 [FMS01]

› 2003: Wi-Fi Protected Access (WPA) › 2004: Wi-Fi Protected Access 2 (WPA2)

Allows offline password brute-force KRACK and Kraken attack [VP][2017-8]

2

slide-3
SLIDE 3

Background: Dragonfly in WPA3 and EAP-pwd

3

Negotiate session key Provide mutual authentication

Prevent offline dictionary attacks

= Password Authenticated Key Exchange (PAKE)

slide-4
SLIDE 4

Dragonfly

4

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Convert password to group element P

slide-5
SLIDE 5

Dragonfly

5

Commit(𝑡𝐵, 𝐹𝐵)

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Commit(𝑡𝐶, 𝐹𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

slide-6
SLIDE 6

Dragonfly

6

Commit(𝑡𝐵, 𝐹𝐵)

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Commit(𝑡𝐶, 𝐹𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

Negotiate shared key

slide-7
SLIDE 7

Dragonfly

7

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

Confirm peer negotiated same key

slide-8
SLIDE 8

Dragonfly

8

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

How to derive P from a password?

  • 1. MODP groups
  • 2. Elliptic curves
slide-9
SLIDE 9

Dragonfly

9

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

How to derive P from a password?

  • 1. MODP groups
  • 2. Elliptic curves
slide-10
SLIDE 10

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

10

slide-11
SLIDE 11

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

11

Half of x values aren’t on the curve

slide-12
SLIDE 12

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

12

slide-13
SLIDE 13

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

13

#iterations depends on password

(and public MAC addresses)

slide-14
SLIDE 14

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

14

#iterations depends on password

(and public MAC addresses)

No timing leak countermeasures, despite warnings by IETF & CFRG!

slide-15
SLIDE 15

Attacking Clients

15

slide-16
SLIDE 16

Attacking Access Points

16

slide-17
SLIDE 17

Leaked information: #iterations needed

17

Client address addrA Measured

slide-18
SLIDE 18

Leaked information: #iterations needed

18

Client address addrA Measured Password 1 Password 2 Password 3

slide-19
SLIDE 19

Leaked information: #iterations needed

19

Client address addrA Measured Password 1 Password 2 Password 3

slide-20
SLIDE 20

What information is leaked?

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

20

Spoof client address to obtain different execution & leak new data

slide-21
SLIDE 21

Leaked information: #iterations needed

21

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-22
SLIDE 22

Leaked information: #iterations needed

22

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-23
SLIDE 23

Leaked information: #iterations needed

23

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

slide-24
SLIDE 24

Leaked information: #iterations needed

24

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

Forms a signature of the password Need ~17 addresses to determine password in RockYou (~𝟐𝟏𝟖) dump

slide-25
SLIDE 25

Raspberry Pi 1 B+: differences are measurable

25

slide-26
SLIDE 26

Raspberry Pi 1 B+: differences are measurable

26

EAP-pwd client: ~30 measurements / address Using Crosby’s box test

slide-27
SLIDE 27

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

27

slide-28
SLIDE 28

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

28

WPA3: always do 40 loops & return first P

slide-29
SLIDE 29

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

29

Blinded constant time square root test

slide-30
SLIDE 30

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

30

Extra iterations based

  • n random password
slide-31
SLIDE 31

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

31

Truncate to size of prime p

slide-32
SLIDE 32

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

32

Brainpool: 𝑞 = 0xA9FB57DBA1EEA9BC…  High chance that x >= p

slide-33
SLIDE 33

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

33

= rejection sampling

slide-34
SLIDE 34

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

34

Code may be skipped

slide-35
SLIDE 35

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

35

#Times skipped depends on password

slide-36
SLIDE 36

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

36

#Times skipped depends on password & random password in extra itreations

slide-37
SLIDE 37

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

37

Variance ~ when password element was found

slide-38
SLIDE 38

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

38

Variance ~ when password element was found Average ~ when found & #iterations code skipped

slide-39
SLIDE 39

Raspberry Pi 1 B+

39

slide-40
SLIDE 40

Raspberry Pi 1 B+

40

WPA3 AP (Hostap): ~300 measurements / address Using Crosby’s box test

slide-41
SLIDE 41

41

Cache Attacks

slide-42
SLIDE 42

Threat Model

42

slide-43
SLIDE 43

Threat Model

43

slide-44
SLIDE 44

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

44

NIST: 𝑞 = 0x0xFFFFFFFF00000001000…  Negligible chance that x >= p

slide-45
SLIDE 45

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

45

NIST curves: use Flush+Reload to detect when code is executed

slide-46
SLIDE 46

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

46

Monitor using Flush+Reload to know in which iteration we are NIST curves: use Flush+Reload to detect when code is executed

slide-47
SLIDE 47

Attacking client: Intel Core i7-7500

47

slide-48
SLIDE 48

Attacking client: Intel Core i7-7500

48

WPA3 client (Hostap): ~20 measurements / address Using Linear Classifier

slide-49
SLIDE 49

Password Brute-force Cost

49

slide-50
SLIDE 50

Implementation Inspection

50

slide-51
SLIDE 51

Other Implementation Vulnerabilities

51

Bad randomness: › Can recover password element P › With WPA2 bad randomness has lower impact! Invalid curve attack: › Attacker sends point not on curve › Recover session key & bypass authentication

slide-52
SLIDE 52

Wi-Fi Specific Attacks

52

slide-53
SLIDE 53

Denial-of-Service Attack

53

Convert password to group element P Convert password to group element P

AP converts password to EC point when client connects

› Conversion is computationally expensive (40 iterations) › Forging 8 connections/sec saturates AP’s CPU

slide-54
SLIDE 54

Downgrade Attacks

Transition mode: WPA2/3 use the same password › WPA2’s handshake detects downgrades › Performing partial WPA2 handshake  dictionary attacks Handshake can be performed with multiple curves › Initiator proposes curve & responder accepts/rejects › Spoof reject messages to downgrade used curve

54

slide-55
SLIDE 55

55

Disclosure

slide-56
SLIDE 56

Disclosure process

Notified parties early with hope to influence WPA3 Reaction of the Wi-Fi Alliance › Privately created backwards-compatible security guidelines › 2nd disclosure round to address Brainpool side-channels › Nov 2019: Updated guidelines now prohibit Brainpool curves

56

slide-57
SLIDE 57

Latest Wi-Fi Alliance guidelines (Nov 2019)

› “implementations must avoid [..] side-channels” › If WPA3-Transition “doesn’t meet security requirements”, then seperate passwords › “Failure to implement...”  how can it be checked?

57

slide-58
SLIDE 58

Fundamental issue still unsolved

› Hard to implement in constant time › On lightweight devices, doing 40 iterations is too costly

58

Draft IEEE 802.11 standard has been updated › Exclude MAC addresses from hash2curve

Allows offline computation of password element

› Now uses constant-time hash2curve › Explicitly prohibit use of weak EC & MODP groups › Prevent crypto group downgrade attack

slide-59
SLIDE 59

Remaining issues

Message transcript is not included in key derivation › Prevents formal proof of protocol › High risk of implementation issues

› E.g. prevention of crypto group downgrade attack

Downgrade to WPA2 › Not addressed in the standard › Up to vendor whether to implement trust-on-first-use

› Done by Android & NetworkManager of Linux

59

slide-60
SLIDE 60

Issue 2: not backwards-compatible

Might lead to WPA3.1? › Not yet clear how Wi-Fi Alliance will handle this › Risk of downgrade attacks to original WPA3

60

Should you switch to WPA3? › WPA2 is trivial to attack... so yes.

slide-61
SLIDE 61

Conclusion

› WPA3 vulnerable to side-channels › Countermeasures are costly › Draft 802.11 standard updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

61

slide-62
SLIDE 62

Thank you! Questions?

› WPA3 vulnerable to side-channels › Countermeasures are costly › Draft 802.11 standard updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

62