Practical Side-Channel Attacks Against WPA-TKIP
summary
Wardriving finds 44.81% of encrypted Wi‑Fi networks still allow WPA‑TKIP, so the team develops practical side‑channel decryptions that recover the last 12 bytes (Michael MIC + ICV) and derive keystream for injection. Attacks exploit power‑save poll, fragmentation cache, and hardware decryption behaviors across Linux, OpenBSD, MediaTek and Broadcom chips, run with provided scripts and Wireshark traces on GitHub, and decrypt a frame in about 1–4 minutes—faster than prior work—and successfully inject forged traffic.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:44Brief Wi-Fi History
- 2:34Wi-Fi Survey
- 3:30Outline
- 4:59TKIP Countermeasures
- 6:00Quality of Service
- 6:39The ChopChop Attack
- 8:42Side-Channels
- 9:27Methodology
- 16:57Fragment 1/2
- 18:45Return of Power Management
- 19:35Hardware Decryption
- 20:43Recall TKIP Header
- 22:30Impact
- 23:20Improvements
- 23:43Countermeasures to our Attacks
- 24:35CTR mode with CBC-MAC Protocol
- 26:04Demonstration.
- 27:57Conclusion
related talks
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
27mPredicting, Decrypting, and Abusing WPA2/802.11 Group Keys
40mSweet Dreams: Abusing Sleep Mode to Break Wi-Fi Encryption and Disrupt WPA2/3 Networks
21mOff-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secrets
35mKr00k: How KRACKing Amazon Echo Exposed a Billion+ Vulnerable Wi-Fi Devices
43mSocial Forensication: A Multidisciplinary Approach to Successful Social Engineering
27mWIFI-Important Remote Attack Surface: Threat is Expanding
33mWi-Fi Brokering