KRACKing WPA2 by Forcing Nonce Reuse Mathy Vanhoef @vanhoefm Chaos - - PowerPoint PPT Presentation

▶
kracking wpa2 by forcing
SMART_READER_LITE
LIVE PREVIEW

KRACKing WPA2 by Forcing Nonce Reuse Mathy Vanhoef @vanhoefm Chaos - - PowerPoint PPT Presentation

Jul 01, 2023 174 likes •848 views

KRACKing WPA2 by Forcing Nonce Reuse Mathy Vanhoef @vanhoefm Chaos Communication Congress (CCC), 27 December 2017 Introduction PhD Defense, July 2016: You recommend WPA2 with AES, but are you sure thats secure? Seems so! No

slide-1
SLIDE 1

KRACKing WPA2 by Forcing Nonce Reuse

Mathy Vanhoef — @vanhoefm Chaos Communication Congress (CCC), 27 December 2017

slide-2
SLIDE 2

Introduction

2

PhD Defense, July 2016: “You recommend WPA2 with AES, but are you sure that’s secure?” Seems so! No attacks in 14 years & proven secure.

slide-3
SLIDE 3
slide-4
SLIDE 4

Introduction

4

Key reinstallation when ic_set_key is called again?

slide-5
SLIDE 5

Overview

5

Key reinstalls in 4-way handshake Misconceptions Lessons learned Practical impact

slide-6
SLIDE 6

Overview

6

Key reinstalls in 4-way handshake Misconceptions Lessons learned Practical impact

slide-7
SLIDE 7

The 4-way handshake

Used to connect to any protected Wi-Fi network › Provides mutual authentication › Negotiates fresh PTK: pairwise temporal key Appeared to be secure: › No attacks in over a decade (apart from password guessing) › Proven that negotiated key (PTK) is secret1 › And encryption protocol proven secure7

7

slide-8
SLIDE 8

4-way handshake (simplified)

8

slide-9
SLIDE 9

4-way handshake (simplified)

9

PTK = Combine(shared secret, ANonce, SNonce)

slide-10
SLIDE 10

4-way handshake (simplified)

10

PTK = Combine(shared secret, ANonce, SNonce)

Attack isn’t about ANonce or SNonce reuse

slide-11
SLIDE 11

4-way handshake (simplified)

11

slide-12
SLIDE 12

4-way handshake (simplified)

12

slide-13
SLIDE 13

4-way handshake (simplified)

13

slide-14
SLIDE 14

4-way handshake (simplified)

14

PTK is installed

slide-15
SLIDE 15

4-way handshake (simplified)

15

slide-16
SLIDE 16

Frame encryption (simplified)

16

Plaintext data

 Nonce reuse implies keystream reuse (in all WPA2 ciphers)

Nonce Mix PTK

(session key)

Nonce

(packet number) Packet key

slide-17
SLIDE 17

4-way handshake (simplified)

17

Installing PTK initializes nonce to zero

slide-18
SLIDE 18

Channel 1

18

Reinstallation Attack

Channel 6

slide-19
SLIDE 19

19

Reinstallation Attack

slide-20
SLIDE 20

20

Reinstallation Attack

slide-21
SLIDE 21

21

Reinstallation Attack

Block Msg4

slide-22
SLIDE 22

22

Reinstallation Attack

slide-23
SLIDE 23

23

Reinstallation Attack

In practice Msg4 is sent encrypted

slide-24
SLIDE 24

24

Reinstallation Attack

slide-25
SLIDE 25

25

Reinstallation Attack

Key reinstallation! nonce is reset

slide-26
SLIDE 26

26

Reinstallation Attack

slide-27
SLIDE 27

27

Reinstallation Attack

Same nonce is used!

slide-28
SLIDE 28

28

Reinstallation Attack Keystream

slide-29
SLIDE 29

29

Reinstallation Attack Keystream Decrypted!

slide-30
SLIDE 30

Key Reinstallation Attack

Other Wi-Fi handshakes also vulnerable: › Group key handshake › FT handshake › TDLS PeerKey handshake For details see our CCS’17 paper12: › “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2”

30

slide-31
SLIDE 31

Overview

31

Key reinstalls in 4-way handshake Misconceptions Lessons learned Practical impact

slide-32
SLIDE 32

General impact

32

Receive replay counter reset Replay frames towards victim Transmit nonce reset Decrypt frames sent by victim

slide-33
SLIDE 33

Cipher suite specific

AES-CCMP: No practical frame forging attacks WPA-TKIP: › Recover Message Integrity Check key from plaintext4,5 › Forge/inject frames sent by the device under attack GCMP (WiGig): › Recover GHASH authentication key from nonce reuse6 › Forge/inject frames in both directions

33

slide-34
SLIDE 34

Handshake specific

Group key handshake: › Client is attacked, but only AP sends real broadcast frames

34

slide-35
SLIDE 35

Unicast

Handshake specific

Group key handshake: › Client is attacked, but only AP sends real broadcast frames

35

slide-36
SLIDE 36

Handshake specific

Group key handshake: › Client is attacked, but only AP sends real broadcast frames › Can only replay broadcast frames to client 4-way handshake: client is attacked  replay/decrypt/forge FT handshake (fast roaming = 802.11r): › Access Point is attacked  replay/decrypt/forge › No MitM required, can keep causing nonce resets

36

slide-37
SLIDE 37

FT Handshake

37

slide-38
SLIDE 38

FT Handshake

38

slide-39
SLIDE 39

FT Handshake

39

slide-40
SLIDE 40

FT Handshake

40

slide-41
SLIDE 41

FT Handshake

41

slide-42
SLIDE 42

FT Handshake

42

slide-43
SLIDE 43

FT Handshake

43

Nonce reuse! Use to decrypt frames

slide-44
SLIDE 44

Implementation specific

iOS 10 and Windows: 4-way handshake not affected › Cannot decrypt unicast traffic (nor replay/decrypt) › But group key handshake is affected (replay broadcast) › Note: iOS 11 does have vulnerable 4-way handshake8 wpa_supplicant 2.4+ › Client used on Linux and Android 6.0+ › On retransmitted msg3 will install all-zero key

44

slide-45
SLIDE 45

45

slide-46
SLIDE 46

46

Android (victim)

slide-47
SLIDE 47

47

slide-48
SLIDE 48

48

slide-49
SLIDE 49

49

slide-50
SLIDE 50

50

slide-51
SLIDE 51

51

Now trivial to intercept and manipulate client traffic

slide-52
SLIDE 52

Is your devices affected?

github.com/vanhoefm/krackattacks-scripts

52

› Tests clients and APs › Works on Kali Linux Remember to: › Disable hardware encryption › Use a supported Wi-Fi dongle!

slide-53
SLIDE 53

Countermeasures

Many clients won’t get updates… AP can prevent (most) attacks on clients! › Don’t retransmit message 3/4 › Don’t retransmit group message 1/2 However: › Impact on reliability unclear › Clients still vulnerable when connected to unmodified APs

53

slide-54
SLIDE 54

Overview

54

Key reinstalls in 4-way handshake Misconceptions Lessons learned Practical impact

slide-55
SLIDE 55

Misconceptions I

Updating only the client or AP is sufficient › Both vulnerable clients & vulnerable APs must apply patches Need to be close to network and victim › Can use special antenna from afar Must be connected to network as attacker (i.e. have password) › Only need to be nearby victim and network

55

slide-56
SLIDE 56

Misconceptions II

No useful data is transmitted after handshake › Trigger new handshakes during TCP connection Obtaining channel-based MitM is hard › Nope, can use channel switch announcements Attack complexity is hard › Script only needs to be written once … › … and some are (privately) doing this!

56

slide-57
SLIDE 57

Misconceptions III

Using (AES-)CCMP mitigates the attack › Still allows decryption & replay of frames Enterprise networks (802.1x) aren’t affected › Also use 4-way handshake & are affected It’s the end of the world! › Let’s not get carried away 

57

Image from “KRACK: Your Wi-Fi is no longer secure” by Kaspersky

slide-58
SLIDE 58

Overview

58

Key reinstalls in 4-way handshake Misconceptions Lessons learned Practical impact

slide-59
SLIDE 59

Limitations of formal proofs

› 4-way handshake proven secure › Encryption protocol proven secure

59

The combination was not proven secure!

slide-60
SLIDE 60

Keep protocols simple

The wpa_supplicant 2.6 case: › Complex state machine & turned out to still be vulnerable › Need formal verification of implementations

60

“Re-keying introduces unnecessary complexity (and therefore opportunities for bugs or other unexpected behavior) without delivering value in return.” 9

slide-61
SLIDE 61

Need rigorous specifications

Original WPA2 standard › State machine doesn’t define when messages are accepted 802.11r amendment › Better defines how/when to handle messages › But some terms and cases still unclear

61

slide-62
SLIDE 62

On a related note…

Workshop on:

Security Protocol Implementations: Development and Analysis (SPIDA)

CFP deadline is 8 January Co-located with EuroS&P 2018 and “focuses on improving development & analysis of security protocol implementations”

62

slide-63
SLIDE 63

Disclosure coordination I

Flawed standard: many affected, how to disclose? Is it really a widespread issue? › Contacted vendors we didn’t test ourselves › They’re vulnerable  it’s widespread & feedback on report Determining who should be informed? › Rely on a CERT team, or ask vendors for other contacts › Notifying more vendors  higher chance of leaks

63

slide-64
SLIDE 64

Disclosure coordination II

Duration of embargo? › Long embargo: risk of details leaking › Short embargo: not enough time to patch › Do avoid uncertainty by setting a clear deadline Special thanks to:

64

slide-65
SLIDE 65

Conclusion

› Flaw is in WPA2 standard › Proven correct but is insecure! › Attack has practical impact › Update all clients & check APs

65

slide-66
SLIDE 66

Questions?

krackattacks.com

Thank you!

slide-67
SLIDE 67

References

1.

  • C. He, M. Sundararajan, A. Datta, A. Derek, and J. Mitchell. A Modular Correctness Proof of IEEE 802.11i and TLS. In CCS, 2005.

2.

  • S. Antakis, M. van Cuijk, and J. Stemmer. Wardriving - Building A Yagi Pringles Antenna. 2008.

3.

  • M. Parkinson. Designer Cantenna. 2012. Retrieved 23 October 2017 from https://www.mattparkinson.eu/designer-cantenna/

4.

  • E. and M. Beck. Practical attacks against WEP and WPA. In WiSec, 2009.

5.

  • M. Vanhoef and F. Piessens. Practical verification of WPA-TKIP vulnerabilities. In ASIA CCS, 2013.

6.

  • A. Joux. Authentication failures in NIST version of GCM. 2016.

7.

  • J. Jonsson. On the security of CTR+ CBC-MAC. In SAC, 2002.

8.

  • Apple. About the security content of iOS 11.1. November 3, 2017. Retrieved 26 November from https://support.apple.com/en-

us/HT208222 9. US Central Intelligence Agency. Network Operations Division Cryptographic Requirements. Retrieved 5 December 2017 from https://wikileaks.org/ciav7p1/cms/files/NOD%20Cryptographic%20Requirements%20v1.1%20TOP%20SECRET.pdf

  • 10. J. Salowey and E. Rescorla. TLS Renegotiation Vulnerability. Retrieved 5 December 2017 from

https://www.ietf.org/proceedings/76/slides/tls-7.pdf

  • 11. Bhargavan et al. Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS. In IEEE S&P, 2014.
  • 12. M. Vanhoef and F. Piessens. Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2. In CCS, 2017.

67