3

I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full understanding from start to finish, and I can't find what I need for the very beginning.

Since WEP can operate on four keys, something needs to be able to generate four keys. My router can do this based off a passphrase. If I put 'badpw' as the passphrase, I get the keys:

1: 02CB778981
2: C27236DFB1
3: C90C104FA2
4: A804571CC0

If I enter the same passphrase on http://www.wepkey.com/, I get the same four keys. So its clear that the same algorithm is used in both cases, but I can't for the life of me find it.

So, what would the psudocode be to derive those four WEP keys from a passphrase?

3

Shamelessly stolen from the client-side JavaScript code of http://www.wepkey.com:

function wepkey64(val)
{
    var pseed  = new Array(4);
        pseed[0] = 0; pseed[1] = 0; pseed[2] = 0; pseed[3] = 0;
    var randNumber;
    var k64 = new Array(4);
        k64[0] = ""; k64[1] = ""; k64[2] = ""; k64[3] = "";
    var i, j, tmp;
    for (i = 0; i < val.length; i++)
    {
        pseed[i%4] ^= val.charCodeAt(i);
    };
    randNumber = pseed[0] | (pseed[1] << 8) | (pseed[2] << 16) | (pseed[3] << 24);
    for (i = 0; i < 4; i++)
    {
        for (j = 0; j < 5; j++)
        {
            randNumber = (randNumber * 0x343fd + 0x269ec3) & 0xffffffff;
            tmp = (randNumber >> 16) & 0xff;
            k64[i] += bin2hex(tmp);
        };
    };
    return k64;
};

// converts one byte to a 2 chars hex string
function bin2hex(val)
{
    var hex = "0123456789ABCDEF";
    var result = "";
    var index;
    index = (val >> 4) & 0x0f;
    result = result + hex.substring(index, index+1);
    index = val & 0x0f;
    result = result + hex.substring(index, index+1);
    return result;
}

Call wepkey64("your key") to calculate the four 64-bit keys. They will be returned as an array.

  • Can't believe I didn't think of stealing that. Thank you! – Nicholas Dechert Jan 16 '16 at 22:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.