Why don't WiFi networks tell you that you have the wrong password?

Question

On my Ubuntu if I enter the incorrect password for a WiFi, there is a brief pause and then I am prompted to enter it again. With the identical dialogue. I noticed the same, or similar behavior with several other devices. That is, you are not explicitly told that you gave the wrong password, instead you see that something is not working, but don't know what.

I am wondering, is this behavior specific to the user interface that handles connection to the WiFi, or is it an intrinsic part of a protocol or a standard that is used by WiFi? Are there some safety reasons behind this behavior?

Answer 1

Normally, behaviour like this is implemented to prevent Side Channel attacks. The different behaviour of getting a message that is completely invalid and one that is partly correct can be exploited to recover the key.

This allows for a very hollywood-style decryption; recovering the high-order bytes first (here RSA)

In WPS this type of attack allows you to brute force the 8-digit key in max 1.1*10e4-2 tries. one digit is a checksum, so this is known. The access point returns a different error if 3 digits are correct. So this is bruteforced first in max 999 tries, leaving max 9999 tries for the rest of the PIN

However:

The RFC protocol specification of EAP, a widely used authentication, does not forbid the signaling of failed authentication And the IPhone does show this specific error