Forum

http://www.nytimes.com/external/idg/2008/11/06/06idg-Once-thought-sa.html

Thanks for posting, Seth. I just found out about it myself and the first place I thought of going to was the CWNP forums.

Apparently this is part of aircrack-ng as of the last two weeks or so. One of us should investigate this. Because the articles I see lack detail I'm trying to interpret the severity of the issue. It looks like the broadcast/multicast traffic (group cipher) is what is cracked and they haven't figured out the pairwise cipher, which is arguably the golden prize. (unicast traffic)

However, this is perhaps just a start. It seems that there is a technique that they are using for the AP to respond with a lot of traffic in order for them to be able to track it easier. I'd like to know if any of you have the technical details.

Shawn, CWNE #54

TKIP HAS NOT BEEN CRACKED!!!!

This is incorrect and the article is poorly written. Read on...

Read these two quotes from the article:

"There, researcher Erik Tews will show how he was able to crack WPA encryption, in order to read data being sent from a router to a laptop computer."

"They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack"

These two statements are contradictory. Now, read this quote:

"Security experts had known that TKIP could be cracked using what's known as a dictionary attack."

The problem is, the author is using the term WPA-PSK and TKIP interchangeably. Perfect. One is authentication that has been cracked for years, the other is an encryption scheme.

The researchers have found a way to crack the WPA-PSK passphrase faster, and for that I commend them. Once you have the passphrase, you can then derive the encryption cipher as long as you have the four way handshake.

However, WPA-PSK authentication has never been recommended for the enterprise and any enterprise that uses it was making a mistake even before this hack. Why do you think it is called WPA-Personal?

TKIP is safe. Use TKIP all you want, it isn't going to be cracked anytime soon.

GT

"A new wireless standard known as WPA2 is considered safe from the attack developed by Tews and Beck, but many WPA2 routers also support WPA."

Yep it's new. Only 4 1/2 years old. Do they not do a tech review for this stuff???


GT

While I completely agree with your statements about PSK and enterprise, etc. I can't read enough from these articles to be as certain as you are in interpreting these statements. Yeah, why the heck are they using the term *router*?

It would be hard to imagine that this is just another PSK crack since they are specifically using TKIP versus AES-CCMP.

Bottom line is that the writers of these articles don't provide the necessary information to interpret the details and we need to go verify this to understand the details involved.

I'm not saying that I have any more to go on that anyone else. I'm just telling everyone not to panic like the media likes us to do. TKIP is fine.

WPA-PSK? Not fine, but guess what, you should only be using it at home anyway.

GT

I agree, this was not meant to panic anybody, just to get people to keep on eye on how this evolves.

They are also failing to mention how if you have to use PSK that to use minimum 10 character, upper, lower, alpha-numeric and special character to avoid the dictionary attack. As much as you can warn people about that they still use simple common phrases and then wonder how they got hacked.

Interesting conversation though.

http://www.securityfocus.com/news/11537?ref=rss
More details here.

As Shawn pointed out I could understand that group cipher is the victim.

I know there are some companies that prefer to disable the TKIP countermeasures in the AP instead of worrying about old/faulty client drivers (that causes MIC failures) upgrade. In that case I think the attack will be much faster.

http://arstechnica.com/articles/paedia/wpa-cracked.ars
Key is not the victim, but very interesting

I appreciate the link to these articles. They are much better written go to show that the other writings had a lot of flair.

The research is very admirable, but we as wireless professionals need to make sure our clients don't overreact and go down a the famous path of running to momma... VPN.

GT