Cryptanalysis for RC4 and Breaking WEP/WPA-TKIP

Masakatu MORII; Yosuke TODO

doi:10.1587/transinf.E94.D.2087

Open Access
Cryptanalysis for RC4 and Breaking WEP/WPA-TKIP

Masakatu MORII, Yosuke TODO

Full Text Views

124

Share
Cite this

Free PDF (505.6KB)

Summary :

In recent years, wireless LAN systems are widely used in campuses, offices, homes and so on. It is important to discuss the security aspect of wireless LAN networks in order to protect data confidentiality and integrity. The IEEE Standards Association formulated some security protocols, for example, Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). However, these protocols have vulnerability for secure communication. In 2008, we proposed an efffective key recovery attack against WEP and it is called the TeAM-OK attack. In this paper, first, we present a different interpretation and the relation between other attacks and the TeAM-OK attack against WEP. Second, we present some existing attacks against WPA-TKIP and these attacks are not executable in a realistic environment. Then we propose an attack that is executable in a realistic environment against WPA-TKIP. This attack exploits the vulnerability implementation in the QoS packet processing feature of IEEE 802.11e. The receiver receives a falsification packet constructed as part of attack regardless of the setting of IEEE 802.11e. This vulnerability removes the attacker's condition that access points support IEEE 802.11e. We confirm that almost all wireless LAN implementations have this vulnerability. Therefore, almost all WPA-TKIP implementations cannot protect a system against the falsification attack in a realistic environment.

Publication: IEICE TRANSACTIONS on Information Vol.E94-D No.11 pp.2087-2094

Publication Date: 2011/11/01

Publicized

Online ISSN: 1745-1361

DOI: 10.1587/transinf.E94.D.2087

Type of Manuscript: Special Section INVITED PAPER (Special Section on Information and Communication System Security)

Category

Cite this

Copy

Masakatu MORII, Yosuke TODO, "Cryptanalysis for RC4 and Breaking WEP/WPA-TKIP" in IEICE TRANSACTIONS on Information, vol. E94-D, no. 11, pp. 2087-2094, November 2011, doi: 10.1587/transinf.E94.D.2087.
Abstract: In recent years, wireless LAN systems are widely used in campuses, offices, homes and so on. It is important to discuss the security aspect of wireless LAN networks in order to protect data confidentiality and integrity. The IEEE Standards Association formulated some security protocols, for example, Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). However, these protocols have vulnerability for secure communication. In 2008, we proposed an efffective key recovery attack against WEP and it is called the TeAM-OK attack. In this paper, first, we present a different interpretation and the relation between other attacks and the TeAM-OK attack against WEP. Second, we present some existing attacks against WPA-TKIP and these attacks are not executable in a realistic environment. Then we propose an attack that is executable in a realistic environment against WPA-TKIP. This attack exploits the vulnerability implementation in the QoS packet processing feature of IEEE 802.11e. The receiver receives a falsification packet constructed as part of attack regardless of the setting of IEEE 802.11e. This vulnerability removes the attacker's condition that access points support IEEE 802.11e. We confirm that almost all wireless LAN implementations have this vulnerability. Therefore, almost all WPA-TKIP implementations cannot protect a system against the falsification attack in a realistic environment.
URL: https://globals.ieice.org/en_transactions/information/10.1587/transinf.E94.D.2087/_p

Copy

@ARTICLE{e94-d_11_2087,
author={Masakatu MORII, Yosuke TODO, },
journal={IEICE TRANSACTIONS on Information},
title={Cryptanalysis for RC4 and Breaking WEP/WPA-TKIP},
year={2011},
volume={E94-D},
number={11},
pages={2087-2094},
abstract={In recent years, wireless LAN systems are widely used in campuses, offices, homes and so on. It is important to discuss the security aspect of wireless LAN networks in order to protect data confidentiality and integrity. The IEEE Standards Association formulated some security protocols, for example, Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). However, these protocols have vulnerability for secure communication. In 2008, we proposed an efffective key recovery attack against WEP and it is called the TeAM-OK attack. In this paper, first, we present a different interpretation and the relation between other attacks and the TeAM-OK attack against WEP. Second, we present some existing attacks against WPA-TKIP and these attacks are not executable in a realistic environment. Then we propose an attack that is executable in a realistic environment against WPA-TKIP. This attack exploits the vulnerability implementation in the QoS packet processing feature of IEEE 802.11e. The receiver receives a falsification packet constructed as part of attack regardless of the setting of IEEE 802.11e. This vulnerability removes the attacker's condition that access points support IEEE 802.11e. We confirm that almost all wireless LAN implementations have this vulnerability. Therefore, almost all WPA-TKIP implementations cannot protect a system against the falsification attack in a realistic environment.},
keywords={},
doi={10.1587/transinf.E94.D.2087},
ISSN={1745-1361},
month={November},}

Copy

TY - JOUR
TI - Cryptanalysis for RC4 and Breaking WEP/WPA-TKIP
T2 - IEICE TRANSACTIONS on Information
SP - 2087
EP - 2094
AU - Masakatu MORII
AU - Yosuke TODO
PY - 2011
DO - 10.1587/transinf.E94.D.2087
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E94-D
IS - 11
JA - IEICE TRANSACTIONS on Information
Y1 - November 2011
AB - In recent years, wireless LAN systems are widely used in campuses, offices, homes and so on. It is important to discuss the security aspect of wireless LAN networks in order to protect data confidentiality and integrity. The IEEE Standards Association formulated some security protocols, for example, Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). However, these protocols have vulnerability for secure communication. In 2008, we proposed an efffective key recovery attack against WEP and it is called the TeAM-OK attack. In this paper, first, we present a different interpretation and the relation between other attacks and the TeAM-OK attack against WEP. Second, we present some existing attacks against WPA-TKIP and these attacks are not executable in a realistic environment. Then we propose an attack that is executable in a realistic environment against WPA-TKIP. This attack exploits the vulnerability implementation in the QoS packet processing feature of IEEE 802.11e. The receiver receives a falsification packet constructed as part of attack regardless of the setting of IEEE 802.11e. This vulnerability removes the attacker's condition that access points support IEEE 802.11e. We confirm that almost all wireless LAN implementations have this vulnerability. Therefore, almost all WPA-TKIP implementations cannot protect a system against the falsification attack in a realistic environment.
ER -