Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal Ronen - - PowerPoint PPT Presentation

▶
dragonfly handshake of
SMART_READER_LITE
LIVE PREVIEW

Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal Ronen - - PowerPoint PPT Presentation

Sep 01, 2023 520 likes •1.59k views

Dragonblood : Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd Mathy Vanhoef and Eyal Ronen Background: Wi-Fi Security 1999: Wired Equivalent Privacy (WEP) RC4 with 40 (!) or 104 bits key Broken in 2001 [FMS01] Deprecated 2004 2

slide-1
SLIDE 1

Mathy Vanhoef and Eyal Ronen

Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd

slide-2
SLIDE 2

Background: Wi-Fi Security

› 1999: Wired Equivalent Privacy (WEP)

RC4 with 40 (!) or 104 bits key Broken in 2001 [FMS01] Deprecated 2004

2

slide-3
SLIDE 3

Background: Wi-Fi Security

› 1999: Wired Equivalent Privacy (WEP)

RC4 with 40 (!) or 104 bits key Broken in 2001 [FMS01] Deprecated 2004

› 2003: Wi-Fi Protected Access (WPA)

2

slide-4
SLIDE 4

Background: Wi-Fi Security

› 1999: Wired Equivalent Privacy (WEP)

RC4 with 40 (!) or 104 bits key Broken in 2001 [FMS01] Deprecated 2004

› 2003: Wi-Fi Protected Access (WPA) › 2004: Wi-Fi Protected Access 2 (WPA2)

Allows offline password brute-force KRACK and Kraken attack [VP][2017-8]

2

slide-5
SLIDE 5

Background: Dragonfly in WPA3 and EAP-pwd

3

= Password Authenticated Key Exchange (PAKE)

slide-6
SLIDE 6

Background: Dragonfly in WPA3 and EAP-pwd

3

Provide mutual authentication = Password Authenticated Key Exchange (PAKE)

slide-7
SLIDE 7

Background: Dragonfly in WPA3 and EAP-pwd

3

Negotiate session key Provide mutual authentication = Password Authenticated Key Exchange (PAKE)

slide-8
SLIDE 8

Background: Dragonfly in WPA3 and EAP-pwd

3

Negotiate session key Provide mutual authentication

Prevent offline dictionary attacks

= Password Authenticated Key Exchange (PAKE)

slide-9
SLIDE 9

Our Results [VR 20]

› Comprehensive analysis of WPA3

First attacks against the new protocol Break most of the security guarantees Provide PoC for attacks

› Recommendations for fixing the crypto design

Resulting in draft for new protocol version

4

slide-10
SLIDE 10

The Dragonfly Protocol

slide-11
SLIDE 11

Dragonfly

6

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

slide-12
SLIDE 12

Dragonfly

6

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Convert password to group element P

slide-13
SLIDE 13

Dragonfly

7

Commit(𝑡𝐵, 𝐹𝐵)

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Commit(𝑡𝐶, 𝐹𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

slide-14
SLIDE 14

Dragonfly

7

Commit(𝑡𝐵, 𝐹𝐵)

Pick random 𝑠

𝐵 and 𝑛𝐵

𝑡𝐵 = 𝑠

𝐵 + 𝑛𝐵 mod 𝑟

𝐹𝐵 = −𝑛𝐵 ∙ 𝑄 Pick random 𝑠

𝐶 and 𝑛𝐶

𝑡𝐶 = 𝑠

𝐶 + 𝑛𝐶 mod 𝑟

𝐹𝐶 = −𝑛𝐶 ⋅ 𝑄

Commit(𝑡𝐶, 𝐹𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

Negotiate shared key

slide-15
SLIDE 15

Dragonfly

8

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

slide-16
SLIDE 16

Dragonfly

9

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

Confirm peer negotiated same key

slide-17
SLIDE 17

Dragonfly

10

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

How to derive P from a password?

  • 1. MODP groups
  • 2. Elliptic curves
slide-18
SLIDE 18

Dragonfly

11

Confirm(𝑑𝐵) Confirm(𝑑𝐶)

Verify 𝑡𝐵 and 𝐹𝐵 𝐿 = 𝑠

𝐶 ⋅ 𝑡𝐵 ∙ 𝑄 + 𝐹𝐵

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐶, 𝐹𝐶, 𝑡𝐵, 𝐹𝐵 𝑑𝐶 = HMAC(𝜆, 𝑢𝑠) Verify 𝑡𝐶 and 𝐹𝐶 𝐿 = 𝑠

𝐵 ⋅ 𝑡𝐶 ∙ 𝑄 + 𝐹𝐶

𝜆 = Hash 𝐿 𝑢𝑠 = 𝑡𝐵, 𝐹𝐵, 𝑡𝐶, 𝐹𝐶 𝑑𝐵 = HMAC(𝜆, 𝑢𝑠)

How to derive P from a password?

  • 1. MODP groups
  • 2. Elliptic curves
slide-19
SLIDE 19

Elliptic Curves

› Operations performed on points (x, y) where:

x < 𝑞 and y < 𝑞 with 𝑞 a prime 𝑧2 = 𝑦3 + 𝑏𝑦 + 𝑐 mod 𝑞 must hold

› Need to convert password pw to point P (x,y) on the curve

12

slide-20
SLIDE 20

Hash2Curve

› Hash2Curve is a hash function H such that:

H is a RO mapping from arbitrary strings into the full group domain:

13

slide-21
SLIDE 21

Hash2Curve

› Hash2Curve is a hash function H such that:

H is a RO mapping from arbitrary strings into the full group domain:

› For WPA3 it was decided that point P is

13

slide-22
SLIDE 22

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

14

slide-23
SLIDE 23

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

14

Half of x values aren’t on the curve

slide-24
SLIDE 24

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

15

slide-25
SLIDE 25

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

15

#iterations depends on password

(and public MAC addresses)

slide-26
SLIDE 26

Hash-to-curve: EAP-pwd

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

15

#iterations depends on password

(and public MAC addresses)

No timing leak countermeasures, despite warnings by IETF & CFRG!

slide-27
SLIDE 27

Attacking Clients

16

slide-28
SLIDE 28

Attacking Clients

16

slide-29
SLIDE 29

Attacking Access Points

17

slide-30
SLIDE 30

Leaked information: #iterations needed

18

Client address addrA Measured

slide-31
SLIDE 31

Leaked information: #iterations needed

19

Client address addrA Measured Password 1 Password 2 Password 3

slide-32
SLIDE 32

Leaked information: #iterations needed

20

Client address addrA Measured Password 1 Password 2 Password 3

slide-33
SLIDE 33

What information is leaked?

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

21

slide-34
SLIDE 34

What information is leaked?

for (counter = 1; counter < 40; counter++) x = hash(pw, addr1, addr2, counter) if x >= p: continue if square_root_exists(x) and not P: return (x, 𝑦3 + 𝑏𝑦 + 𝑐)

21

Spoof client address to obtain different execution & leak new data

slide-35
SLIDE 35

Leaked information: #iterations needed

22

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-36
SLIDE 36

Leaked information: #iterations needed

22

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-37
SLIDE 37

Leaked information: #iterations needed

23

Client address addrA addrB Measured Password 1 Password 2 Password 3

slide-38
SLIDE 38

Leaked information: #iterations needed

24

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

slide-39
SLIDE 39

Leaked information: #iterations needed

25

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

slide-40
SLIDE 40

Leaked information: #iterations needed

25

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

Need ~17 addresses to determine password in RockYou (~𝟐𝟏𝟖) dump

slide-41
SLIDE 41

Leaked information: #iterations needed

25

Client address addrA addrB addrC Measured Password 1 Password 2 Password 3

Forms a signature of the password Need ~17 addresses to determine password in RockYou (~𝟐𝟏𝟖) dump

slide-42
SLIDE 42

Raspberry Pi 1 B+: differences are measurable

26

slide-43
SLIDE 43

Raspberry Pi 1 B+: differences are measurable

26

EAP-pwd client: ~30 measurements / address Using Crosby’s box test

slide-44
SLIDE 44

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

28

slide-45
SLIDE 45

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

28

WPA3: always do 40 loops & return first P

slide-46
SLIDE 46

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

29

Blinded constant time square root test

slide-47
SLIDE 47

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

30

Extra iterations based

  • n random password
slide-48
SLIDE 48

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

31

Are we Safe?

slide-49
SLIDE 49

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

32

Truncate to size of prime p

slide-50
SLIDE 50

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

33

Brainpool: 𝑞 = 0xA9FB57DBA1EEA9BC…  High chance that x >= p

slide-51
SLIDE 51

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

34

= rejection sampling

slide-52
SLIDE 52

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

35

Code may be skipped

slide-53
SLIDE 53

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

36

#Times skipped depends on password

slide-54
SLIDE 54

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

37

#Times skipped depends on password & random password in extra itreations

slide-55
SLIDE 55

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

38

Variance ~ when password element was found

slide-56
SLIDE 56

Hash-to-curve: WPA3

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

39

Variance ~ when password element was found Average ~ when found & #iterations code skipped

slide-57
SLIDE 57

Raspberry Pi 1 B+

40

slide-58
SLIDE 58

Raspberry Pi 1 B+

40

WPA3 AP (Hostap): ~300 measurements / address Using Crosby’s box test

slide-59
SLIDE 59

41

Cache Attacks

slide-60
SLIDE 60

Threat Model

42

slide-61
SLIDE 61

Threat Model

42

slide-62
SLIDE 62

Threat Model

42

slide-63
SLIDE 63

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

43

NIST: 𝑞 = 0x0xFFFFFFFF00000001000…  Negligible chance that x >= p

slide-64
SLIDE 64

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

44

NIST curves: use Flush+Reload to detect when code is executed

slide-65
SLIDE 65

Cache attack on NIST curves

for (counter = 1; counter < 40; counter++) x = hash(pw, counter, addr1, addr2) if x >= p: continue if square_root_exists(x) and not P: P = (x, 𝑦3 + 𝑏𝑦 + 𝑐) pw = rand() return P

44

Monitor using Flush+Reload to know in which iteration we are NIST curves: use Flush+Reload to detect when code is executed

slide-66
SLIDE 66

Attacking client: Intel Core i7-7500

45

slide-67
SLIDE 67

Attacking client: Intel Core i7-7500

46

WPA3 client (Hostap): ~20 measurements / address Using Linear Classifier

slide-68
SLIDE 68

Detailed Analysis: See Paper

› Estimate required #(spoofed MAC addresses):

47

slide-69
SLIDE 69

Detailed Analysis: See Paper

› Estimate required #(spoofed MAC addresses):

47

› Offline brute-force cost:

slide-70
SLIDE 70

Password Brute-force Cost

48

slide-71
SLIDE 71

Implementation Inspection

49

slide-72
SLIDE 72

Invalid Curve Attack

50

Commit(x’, y’)

slide-73
SLIDE 73

Invalid Curve Attack

50

Commit(x’, y’)

Point isn’t on curve

slide-74
SLIDE 74

Invalid Curve Attack

50

Commit(x’, y’)

Point isn’t on curve

Negotiated key is predictable

slide-75
SLIDE 75

Invalid Curve Attack

50

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable Guess key and send confirm

slide-76
SLIDE 76

Invalid Curve Attack

50

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable Guess key and send confirm Confirm phase

slide-77
SLIDE 77

Invalid Curve Attack

50

Commit(x’, y’) Commit reply

Point isn’t on curve

Negotiated key is predictable Guess key and send confirm Confirm phase

Bypasses authentication

  • EAP-pwd: all implementations affected
  • WPA3: only iwd is vulnerable
slide-78
SLIDE 78

Reflection Attack: EAP-pwd example

51

association

slide-79
SLIDE 79

Reflection Attack: EAP-pwd example

51

Commit(x, y) association

slide-80
SLIDE 80

Reflection Attack: EAP-pwd example

51

Commit(x, y) Commit(x, y) Reflect frame association

slide-81
SLIDE 81

Reflection Attack: EAP-pwd example

51

Commit(x, y) Commit(x, y) Reflect frame Confirm association

slide-82
SLIDE 82

Reflection Attack: EAP-pwd example

51

Commit(x, y) Commit(x, y) Reflect frame Confirm Confirm Reflect frame association

slide-83
SLIDE 83

Reflection Attack: EAP-pwd example

51

Commit(x, y) Commit(x, y) Reflect frame Confirm Confirm Reflect frame association

Authenticate as victim

  • EAP-pwd: all servers are vulnerable
  • WPA3: old wpa_supplicants affected
slide-84
SLIDE 84

Other Implementation Vulnerabilities

52

Bad randomness: › Can recover password element P › Aruba’s EAP-pwd client for Windows is affected › With WPA2 bad randomness has lower impact!

slide-85
SLIDE 85

Other Implementation Vulnerabilities

52

Bad randomness: › Can recover password element P › Aruba’s EAP-pwd client for Windows is affected › With WPA2 bad randomness has lower impact! Side-channels: › FreeRADIUS aborts if >10 iterations are needed › Aruba’s EAP-pwd aborts if >30 are needed › Can use leaked info to recover password

slide-86
SLIDE 86

Wi-Fi Specific Attacks

54

slide-87
SLIDE 87

Denial-of-Service Attack

55

Convert password to group element P Convert password to group element P

AP converts password to EC point when client connects

› Conversion is computationally expensive (40 iterations) › Forging 8 connections/sec saturates AP’s CPU

slide-88
SLIDE 88

Downgrade Attacks

Transition mode: WPA2/3 use the same password › WPA2’s handshake detects downgrades

56

slide-89
SLIDE 89

Downgrade Attacks

Transition mode: WPA2/3 use the same password › WPA2’s handshake detects downgrades › Performing partial WPA2 handshake  dictionary attacks

56

slide-90
SLIDE 90

Downgrade Attacks

Transition mode: WPA2/3 use the same password › WPA2’s handshake detects downgrades › Performing partial WPA2 handshake  dictionary attacks Handshake can be performed with multiple curves › Initiator proposes curve & responder accepts/rejects › Spoof reject messages to downgrade used curve

56

slide-91
SLIDE 91

Implementation-specific downgrades

› Clone WPA3-only network & advertise it only supports WPA2

57

iwd

slide-92
SLIDE 92

Implementation-specific downgrades

› Clone WPA3-only network & advertise it only supports WPA2 › Galaxy S10 & iwd connected using the WPA3-only password › Results in trivial dictionary attack

57

iwd

slide-93
SLIDE 93

58

Disclosure

slide-94
SLIDE 94

Disclosure process

Notified parties early with hope to influence WPA3 Reaction of the Wi-Fi Alliance › Privately created backwards-compatible security guidelines › 2nd disclosure round to address Brainpool side-channels › Nov 2019: Updated guidelines now prohibit Brainpool curves

59

slide-95
SLIDE 95

Latest Wi-Fi Alliance guidelines (Nov 2019)

› “implementations must avoid [..] side-channels”

60

slide-96
SLIDE 96

Latest Wi-Fi Alliance guidelines (Nov 2019)

› “implementations must avoid [..] side-channels” › If WPA3-Transition “doesn’t meet security requirements”, then seperate passwords

60

slide-97
SLIDE 97

Latest Wi-Fi Alliance guidelines (Nov 2019)

› “implementations must avoid [..] side-channels” › If WPA3-Transition “doesn’t meet security requirements”, then seperate passwords › “Failure to implement...”  how can it be checked?

60

slide-98
SLIDE 98

Fundamental issue still unsolved

› Hard to implement in constant time › On lightweight devices, doing 40 iterations is too costly

61

slide-99
SLIDE 99

Fundamental issue still unsolved

› Hard to implement in constant time › On lightweight devices, doing 40 iterations is too costly

61

Draft IEEE 802.11 standard has been updated › Exclude MAC addresses from hash2curve

Allows offline computation of password element

› Now uses constant-time hash2curve › Explicitly prohibit use of weak EC & MODP groups › Prevent crypto group downgrade attack

slide-100
SLIDE 100

Remaining issues

Message transcript is not included in key derivation › Prevents formal proof of protocol › High risk of implementation issues

› E.g. prevention of crypto group downgrade attack

62

slide-101
SLIDE 101

Remaining issues

Message transcript is not included in key derivation › Prevents formal proof of protocol › High risk of implementation issues

› E.g. prevention of crypto group downgrade attack

Downgrade to WPA2 › Not addressed in the standard › Up to vendor whether to implement trust-on-first-use

› Done by Android & NetworkManager of Linux

62

slide-102
SLIDE 102

Issue 2: not backwards-compatible

Might lead to WPA3.1? › Not yet clear how Wi-Fi Alliance will handle this › Risk of downgrade attacks to original WPA3

63

slide-103
SLIDE 103

Issue 2: not backwards-compatible

Might lead to WPA3.1? › Not yet clear how Wi-Fi Alliance will handle this › Risk of downgrade attacks to original WPA3

63

Should you switch to WPA3? › WPA2 is trivial to attack... so yes.

slide-104
SLIDE 104

Conclusion

› WPA3 vulnerable to side-channels › Countermeasures are costly › Draft 802.11 standard updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

64

slide-105
SLIDE 105

Thank you! Questions?

› WPA3 vulnerable to side-channels › Countermeasures are costly › Draft 802.11 standard updated › Issues could have been avoided! https://wpa3.mathyvanhoef.com

65