The TKIP handshake is halfway completed; the access point and station have exchanged the first two messages. Now, before the access point can send the third message to the station an attacker sends a fake message containing the authentic MAC of the access point, the correct sequence number, but a fake nonce. What would an attacker be able to do with this attack? Also, is the MIC that is part of this message ever checked by the station?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.