Timeline for KRACK interim guidance stopgap
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 24, 2017 at 7:46 | answer | added | defalt | timeline score: 1 | |
| Oct 24, 2017 at 1:49 | comment | added | Andyz Smith | Ok i got it see accepted answer to wit disconnecting session is enough to generate new safe ciphertext unless of course attacker is still physically in range :) :( ?? | |
| Oct 24, 2017 at 1:46 | vote | accept | Andyz Smith | ||
| Oct 24, 2017 at 0:06 | comment | added | Mark | @AndyzSmith, WPA/WPA2 uses many different keys at different steps in the communication process. The PSK is only used during the authentication process, to let the client and AP prove to each other that they're who they say they are. KRACK targets a different key, so replacing the PSK will do absolutely nothing to protect your users. | |
| Oct 23, 2017 at 20:35 | answer | added | YLearn | timeline score: 3 | |
| Oct 23, 2017 at 16:00 | comment | added | Andyz Smith | @defalt they can't man unless the whole encryption is just bust. They have to force nonce reuse and I can see that in the AP. Then I can disconnect everybody sweep the physical plant and change the key, securely distribute new key and monitor new handshakes until stabilized and then remote alarm any new handshakes. Irritating but this countermeasure will deter anyone from threatening my high value targets. | |
| Oct 23, 2017 at 15:56 | comment | added | defalt | Even if you keep on changing the PSK every hour, the attacker can still decipher the session of your wifi clients without knowing the session key. Android and Linux devices are more vulnerable because they start using zero encryption key when KRACK is initiated. | |
| Oct 23, 2017 at 15:51 | history | edited | Anders | CC BY-SA 3.0 |
added 7 characters in body; edited tags
|
| Oct 23, 2017 at 15:40 | comment | added | Andyz Smith | @defalt No I change the psk at the AP the nonce repetition used to clue into the ciphertext is obviously ineffective. Traf is secure until the attacker can force and intercept a 3/4 handshake and get some nonce repeats to clue to ciphertext. | |
| Oct 23, 2017 at 15:28 | comment | added | defalt | The attacker doesn't care what your key is. He can still decipher the session of any wifi client connected with your Access Point without having knowledge of key. The attacker can use this method to decipher messages: security.stackexchange.com/a/89841/118310 | |
| Oct 23, 2017 at 14:57 | comment | added | Andyz Smith | @ISMSDEV If I change the psk new attacks have no way to get that unless they attack again my traffic is secure again. If I watch all my trafs and ensure nobody has deauthed since changing psk there is no way attacker can have new key into ciphertext. | |
| Oct 23, 2017 at 14:49 | comment | added | ISMSDEV | I think you are missing the understanding of how the attack works. Why issue the PSK again? The attack doesn't care about the PSK and you could look for deauth messages but changing the PSK wouldn't achieve anything. If you are worried about having your insecure channel intercepted its better to ensure all clients use TLS or VPNs for as much of their communication as possible. At this stage there is no known practical attack so I think you may be over exaggerating your threats, when an attacker would likely take a different path. | |
| Oct 23, 2017 at 14:39 | history | asked | Andyz Smith | CC BY-SA 3.0 |