Smashing WEP in A Passive Attack POUYAN SEPEHRDAD PETR SUSIL - PowerPoint PPT Presentation

Smashing WEP in A Passive Attack POUYAN SEPEHRDAD PETR SUSIL SERGE VAUDENAY MARTIN VUAGNOUX 1

2

No one Uses WEP Any More. 2

Hotels No one Uses WEP Any More. Restaurants Airports 2

Wireless Networks in Singapore: 20% WEP Hotels No one Uses WEP Any More. Restaurants Singapore is not alone. The same problem in most Asia. Airports 2

RC4 3

Reminder on RC4 RC4 3

Reminder on RC4 RC4 RC4/WEP 3

Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP 3

Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP Challenges 3

Reminder on RC4 Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP Challenges 3

KSA PRGA Key S N-1 Keystream 4

1: for i = 0 to N − 1 do 2: S [ i ] ← i 3: end for 4: j ← 0 5: for i = 0 to N − 1 do 6: j ← j + S [ i ]+ K [ i mod L ] 7: swap ( S [ i ] , S [ j ]) 8: end for KSA 5

1: for i = 0 to N − 1 do 2: S [ i ] ← i 3: end for 4: j ← 0 5: for i = 0 to N − 1 do 6: j ← j + S [ i ]+ K [ i mod L ] 7: swap ( S [ i ] , S [ j ]) 8: end for KSA 0 1 2 3 4 5 6 7 8 9 10 11 12 ... 255 i j 5

1: for i = 0 to N − 1 do 2: S [ i ] ← i 3: end for 4: j ← 0 5: for i = 0 to N − 1 do 6: j ← j + S [ i ]+ K [ i mod L ] 7: swap ( S [ i ] , S [ j ]) 8: end for KSA 7 1 2 3 4 5 6 0 8 9 10 11 12 ... 255 i j 6

1: for i = 0 to N − 1 do 2: S [ i ] ← i 3: end for 4: j ← 0 5: for i = 0 to N − 1 do 6: j ← j + S [ i ]+ K [ i mod L ] 7: swap ( S [ i ] , S [ j ]) 8: end for KSA 7 1 2 3 4 5 6 0 8 9 10 11 12 ... 255 i j 7

1: for i = 0 to N − 1 do 2: S [ i ] ← i 3: end for 4: j ← 0 5: for i = 0 to N − 1 do 6: j ← j + S [ i ]+ K [ i mod L ] 7: swap ( S [ i ] , S [ j ]) 8: end for KSA 7 12 2 3 4 5 6 0 8 9 10 11 1 ... 255 i j 8

1: i ← 0 2: j ← 0 3: loop 4: i ← i + 1 5: j ← j + S [ i ] 6: swap ( S [ i ] , S [ j ]) 7: output z i = S [ S [ i ]+ S [ j ]] 8: end loop PRGA 9

1: i ← 0 2: j ← 0 3: loop 4: i ← i + 1 5: j ← j + S [ i ] 6: swap ( S [ i ] , S [ j ]) 7: output z i = S [ S [ i ]+ S [ j ]] 8: end loop PRGA 18 3 211 7 81 245 121 5 66 78 189 34 133 ... 32 i j 9

1: i ← 0 2: j ← 0 3: loop 4: i ← i + 1 5: j ← j + S [ i ] 6: swap ( S [ i ] , S [ j ]) 7: output z i = S [ S [ i ]+ S [ j ]] 8: end loop PRGA 18 7 211 3 81 245 121 5 66 78 189 34 133 ... 32 i j 10

1: i ← 0 2: j ← 0 3: loop 4: i ← i + 1 5: j ← j + S [ i ] 6: swap ( S [ i ] , S [ j ]) 7: output z i = S [ S [ i ]+ S [ j ]] 8: end loop PRGA 18 7 211 3 81 245 121 5 66 78 189 34 133 ... 32 i j Keystream byte = S[7+3]=S[10]=189 11

Reminder on RC4 Reminder on RC4 RC4 RC4/WEP Tornado attack on WEP Challenges 12

Reminder on RC4 RC4 RC4/WEP RC4/WEP Tornado attack on WEP Challenges 12

RC4 z1 z2 z3 ... k[0] k[1] k[2] k[3] ... k[15] 13

RC4 WEP z1 z2 z3 ... k[0] k[1] k[2] k[3] ... k[15] 13

RC4 WEP z1 z2 z3 ... k[3] ... k[15] k[0] k[1] k[2] 13

RC4 WEP z1 z2 z3 ... k[3] ... k[15] k[0] k[1] k[2] the same for each WEP is vulnerable. packet encryption. 13

Reminder on RC4 RC4 RC4/WEP RC4/WEP Tornado Attack on WEP Challenges 14

Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP Tornado Attack on WEP Challenges 14

RC4 Key Keystream 15

RC4 Key Keystream ? 15

 Conditional biases: pairs of ¯ f j , p j with a predicate ¯ g j Pr [ ¯ K [ i ] = ¯ f j ( z , clue ) | ¯ g j ( z , clue )] = p j RC4 Key Keystream ? 15

 Conditional biases: pairs of ¯ f j , p j with a predicate ¯ g j Pr [ ¯ K [ i ] = ¯ f j ( z , clue ) | ¯ g j ( z , clue )] = p j RC4 Key Keystream ? ¯ row reference ¯ f g p P 1 2 − σ i S t [ i ] = 0, z 2 = 0 i A u15 fixed − j 15

 Conditional biases: pairs of ¯ f j , p j with a predicate ¯ g j Pr [ ¯ K [ i ] = ¯ f j ( z , clue ) | ¯ g j ( z , clue )] = p j 22 Biases RC4 Key Keystream ? ¯ row reference ¯ f g p P 1 2 − σ i S t [ i ] = 0, z 2 = 0 i A u15 fixed − j 15

Roos, A.: A class of weak keys in RC4 stream cipher. 1995 Wagner, D.: Weak keys in RC4. 1995 Borisov, N., Goldberg, I., Wagner, D.: Intercepting mobile communications: the insecurity of 802.11. 2001 Fluhrer, S., Mantin, I., Shamir, A.: Weaknesses in the key scheduling algorithm of RC4. 2001 Stubblefield, A., Ioannidis, J., Rubin, A.D.: Using the Fluhrer, Mantin, and Shamir Attack to Break WEP. 2002 Korek: Next generation of WEP attacks? 2004 Devine, C., Otreppe, T.: Aircrack-ng 2004 Martin, J.I.S.: Weplab 2004 Mantin, I.: A practical attack on the fixed RC4 in the WEP mode. 2005 Klein, A.: Attacks on the RC4 stream cipher. 2006 Tews, E., Weinmann, R., Pyshkin, A.: Breaking 104 Bit WEP in Less Than 60 Seconds. 2007 Vaudenay, S., Vuagnoux, M.: Passive–only Key Recovery Attacks on RC4 2007 Beck, M., Tews, E. Practical Attacks Against WEP and WPA. 2009 Sepehrdad, P., Susil, P., Vaudenay, S., Vuagnoux, M.: Smashing WEP in a Passive Attack 2013

Roos, A.: A class of weak keys in RC4 stream cipher. 1995 Wagner, D.: Weak keys in RC4. 1995 Borisov, N., Goldberg, I., Wagner, D.: Intercepting mobile communications: the insecurity of 802.11. 2001 Fluhrer, S., Mantin, I., Shamir, A.: Weaknesses in the key scheduling algorithm of RC4. 2001 Stubblefield, A., Ioannidis, J., Rubin, A.D.: Using the Fluhrer, Mantin, and Shamir Attack to Break WEP. 2002 5500,000 100,000 Korek: Next generation of WEP attacks? 2004 Devine, C., Otreppe, T.: Aircrack-ng 2004 Martin, J.I.S.: Weplab 2004 Mantin, I.: A practical attack on the fixed RC4 in the WEP mode. 2005 60,000 Klein, A.: Attacks on the RC4 stream cipher. 2006 40,000 Tews, E., Weinmann, R., Pyshkin, A.: Breaking 104 Bit WEP in Less Than 60 Seconds. 2007 32,700 Vaudenay, S., Vuagnoux, M.: Passive–only Key Recovery Attacks on RC4 2007 30,000 Beck, M., Tews, E. Practical Attacks Against WEP and WPA. 2009 19,800 Sepehrdad, P., Susil, P., Vaudenay, S., Vuagnoux, M.: Smashing WEP in a Passive Attack 2013

Attack on WEP 1: compute the ranking L 15 for I = (15) and I 0 = { 0 , 1 , 2 } 2: truncate L 15 to its first ρ 15 terms 3: for each ¯ k 15 in L 15 do run recursive attack on input ¯ k 15 4: 5: end for 6: stop: attack failed recursive attack with input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 ) : 7: If input is only ¯ k 15 , set i = 3. 8: if i ≤ i max then compute the ranking L i for I = ( i ) and I 0 = { 0 , . . . , i − 1 , 15 } 9: truncate L i to its first ρ i terms 10: for each ¯ k i in L i do 11: run recursive attack on input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 , ¯ k i ) 12: end for 13: 14: else for each ¯ k i max +1 , . . . , ¯ k 14 do 15: test key (¯ k 3 , . . . , ¯ k 14 , ¯ k 15 ) and stop if correct 16: end for 17: 18: end if 17

Attack on WEP 1: compute the ranking L 15 for I = (15) and I 0 = { 0 , 1 , 2 } 2: truncate L 15 to its first ρ 15 terms 3: for each ¯ k 15 in L 15 do run recursive attack on input ¯ k 15 4: Y x : counter for x 5: end for 6: stop: attack failed R(x): rank of x recursive attack with input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 ) : 7: If input is only ¯ k 15 , set i = 3. 8: if i ≤ i max then compute the ranking L i for I = ( i ) and I 0 = { 0 , . . . , i − 1 , 15 } 9: truncate L i to its first ρ i terms 10: for each ¯ k i in L i do 11: run recursive attack on input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 , ¯ k i ) 12: end for 13: 14: else for each ¯ k i max +1 , . . . , ¯ k 14 do 15: test key (¯ k 3 , . . . , ¯ k 14 , ¯ k 15 ) and stop if correct 16: end for 17: 18: end if 17

Attack on WEP 1: compute the ranking L 15 for I = (15) and I 0 = { 0 , 1 , 2 } 2: truncate L 15 to its first ρ 15 terms 3: for each ¯ k 15 in L 15 do run recursive attack on input ¯ k 15 4: Y x : counter for x 5: end for 6: stop: attack failed R(x): rank of x recursive attack with input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 ) : 7: If input is only ¯ k 15 , set i = 3. 8: if i ≤ i max then compute the ranking L i for I = ( i ) and I 0 = { 0 , . . . , i − 1 , 15 } 9: truncate L i to its first ρ i terms 10: for each ¯ k i in L i do 11: run recursive attack on input (¯ k 15 , ¯ k 3 , . . . , ¯ k i − 1 , ¯ k i ) 12: end for 13: 14: else for each ¯ k i max +1 , . . . , ¯ k 14 do 15: test key (¯ k 3 , . . . , ¯ k 14 , ¯ k 15 ) and stop if correct 16: end for 17: 18: end if The parameters are all optimized 17

Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP Tornado Attack on WEP Challenges 18

Reminder on RC4 RC4 RC4/WEP Tornado Attack on WEP Challenges Challenges 18

In our EUROCRYPT’11 Paper: We made a heuristic assumption that V ( Y good ) ⇥ V ( Y bad ) . In practice: V ( Y good ) ⇤ = V ( Y bad ) We made a heuristic approximation that ( Y good � Y i ) ’s are independent for all bad i ’s. In practice: ( Y good � Y i ) ’s are not independent. Assume the rank R of the correct counter to be normally distributed. In practice: R is not normally distributed. Assume R is following Poisson distribution. In practice E ( R ) ⇤ = V ( R ) . 19

0.25 Polya distribution with p = 0.9839 and r = 0.356 Experimental R 3 distribution for 5000 packets 0.2 0.15 Probability 0.1 0.05 0 0 10 20 30 40 50 R 3 Realization 20