full-disclosure - Re: [Dailydave] Once thought safe, WPA Wi-Fi encryption is cracked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 08 Nov 2008 11:18:49 +0100
From: Cedric Blancher <blancher@...tel-securite.fr>
To: Dragos Ruiu <dr@....net>
Cc: George Ou <george_ou@...architect.net>,
	'Full-Disclosure mailing list' <full-disclosure@...ts.grok.org.uk>,
	'Thierry Zoller' <Thierry@...ler.lu>, dailydave@...ts.immunitysec.com
Subject: Re: [Dailydave]  Once thought safe,
	WPA Wi-Fi	encryption is cracked

Le vendredi 07 novembre 2008 à 19:11 -0800, Dragos Ruiu a écrit :
> I'm afraid I have to disagree. Until you remove the default behaviour  
> of most WPA/WPA2 implementations to downgrade automatically to TKIP from  
> CCMP(AES) when asked to...

A lot of hardware can be configured to provide CCMP only. That's where
we want to go. If you provide CCMP+TKIP, nonetheless you obviously
expose stations using TKIP, but you also expose all group traffic that
will be encrypted using TKIP for everybody, as the common denominator.

> a "weakening" of TKIP is a "weakening" of WPA/WPA2.

Yes. But future 802.11w won't support TKIP. So we can hope it will first
deprecate WEP (802.11i should have done so already), and TKIP hopefully.
At least a WPA3 could do it.

But everything is left to vendors, as they will have to provide
appropriate firmwares and out-of-the-box configurations, which is far to
be true, still now. I was helping a friend setting up his AP last week,
and it was only supporting WPA with TKIP out of the box. We had to
reflash it so we could get the full monthy. And I don't speak of some
drivers that will just fail if you try to do CCMP...

-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/