Key Reinstallation Attacks: Breaking the WPA2 Protocol
summary
A practical exploit forces reinstallation of an already-used WPA2 key by replaying a retransmitted Message 3 of the four‑way handshake, which resets the packet nonce to zero and causes key‑stream reuse so an attacker can decrypt and replay frames; the attack runs as a channel‑based man‑in‑the‑middle clone on a different channel and works against many clients and APs (wpa_supplicant 2.4+ even installs an all‑zero key). AES‑CCMP allows decryption/replay, TKIP/GCMP enable stronger forgeries; test scripts and AP/client patches mitigate it.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:56Overview
- 2:37The 4-way handshake
- 3:484-way handshake (simplified)
- 7:04Frame encryption (simplified)
- 15:33Key Reinstallation Attack
- 16:19General impact
- 17:46Cipher suite specific
- 19:44Handshake specific
- 23:00Implementation specific
- 28:11Countermeasures
- 29:54Misconceptions II
- 36:02Limitations of formal proofs
- 37:36Keep protocols simple
- 40:35Need rigorous specifications
related talks
34mPractical Side-Channel Attacks Against WPA-TKIP
27mPredicting, Decrypting, and Abusing WPA2/802.11 Group Keys
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
33mWi-Fi Brokering
26mThe Dangers of Key Reuse: Practical Attacks on IPsec IKE
44mManna from Heaven: Improving the State of Wireless Rogue AP Attacks
35mKr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices
27mWIFI-Important Remote Attack Surface: Threat is Expanding