To sufficiently protect against KRACK is patching the client, the AP, or both, required?

Question

Following on from this question, I am unclear on which of the following steps are sufficient to protect a WPA2-based wifi connection from the KRACK flaw:

1. Patching the AP (e.g. router)
2. Patching the client (e.g. mobile device)
3. Patching the AP and the client

The currently most upvoted answer, citing https://www.krackattacks.com states:

Both clients and access points are listed in the paper as being vulnerable.

and:

implementations can be patched in a backwards-compatible manner [...] To prevent the attack, users must update affected products as soon as security updates become available. [...] a patched client can still communicate with an unpatched access point, and vice versa.

But this seems to leave open the question of which combination(s) of patches would be an effective fix. It's clear for example that if I were to patch my phone, it would still be able to communicate with an unpatched AP, but would that communication be secure?

This is an important question, because while it is relatively easy to make sure my clients are patched once the patch is available (since the number of OS vendors are relatively small), ensuring all routers are patched (particularly in public wifi APs) seems like a much harder task due to the number and size of the vendors, and the lack of control over third party hardware.

Answer 1

To fully protect your network, both the device and the access point will need to be patched:

Source: https://www.krackattacks.com/#faq

Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks!

Answer 2

TL;DR: It is often (but not always) enough to properly patch the WiFi client.
You need to also patch the router it it works as WiFi client too (e.g., a repeater) or has fast roaming (802.11r) enabled.

The essential part of the attacks is that the client accepts message 3 of the 4-way handshake again which causes the client to re-install the same encryption key and to reset nonce and replay protection - this way making replay and sometimes even injection possible.

This means if the client is patched to not accept a message 3 which contains the same key as already installed it will not reinstall the key and not reset nonce and replay protection. This should be sufficient to thwart the attack, no matter if the server is patched or not.

Also, directly taken from the https://www.krackattacks.com:

What if there are no security updates for my router?

Our main attack is against the 4-way handshake, and does not exploit access points, but instead targets clients. So it might be that your router does not require security updates. We strongly advise you to contact your vendor for more details. In general though, you can try to mitigate attacks against routers and access points by disabling client functionality (which is for example used in repeater modes) and disabling 802.11r (fast roaming). For ordinary home users, your priority should be updating clients such as laptops and smartphones.

Answer 3

According to this IBM XForce post:

[...] Attacks must be within range of the access point and client. Both the client and access point have to be patched in order to be protected from these attacks. If the access point is patched, but not the client, exploitation is still possible.

_{Prior to Tuesday @ 2017-10-17 10:42a CDT: IBM said:}

^{[...] if even only one of the devices (client or access point) has been patched, the pair are not vulnerable to this form of attack.}

^{I left the original text for historical purposes.}

Answer 4

I hear things both ways, it's hard to tell. The paper mentioning both clients and APs sounds like there is at least something to be done on both sides. This comment makes sense to me: "most access points will be fine, but those performing client functions (eg repeaters) will need updating."

Sorry that I cannot give a definitive answer, I'll update if I find one. Hope this helped at least.

Answer 5

One point that may be forgotten is repeaters. If your setup is computer <-> repeater <-> router <-> broadband line, and repeater / router are both unpatched and connected through WiFi, then any traffic between router and repeater could be sniffed indirectly, including anything that your computer sends or receives.

In that situation, if just the repeater is patched, everything is safe. If not, then computer and router must be patched because they both connect to the unpatched repeater.

Answer 6

The official krackattacks.com website now has this FAQ entry:

Is it sufficient to patch only the access point? Or to patch only clients?

Currently, all vulnerable devices should be patched. In other words, patching the AP will not prevent attacks against vulnerable clients. Similarly, patching all clients will not prevent attacks against vulnerable access points. Note that only access points that support the Fast BSS Transition handshake (802.11r) can be vulnerable.

That said, we are working on access points modifications that do prevent attacks against vulnerable clients. These modifications are different from the security patches for vulnerable access points! So unless your access point vendor explicitly mentions that their patches prevent attacks against clients, you must also patch clients.

This explains why there's been so much confusion surrounding this question, both here and elsewhere on the web.

Technically speaking, only the clients (including access points that act as a client, such as repeaters) and access points that support the Fast BSS Transition handshake are vulnerable and need to be fixed.

However, it's possible to modify access points in a way that prevents attacks against clients even if the clients are vulnerable (though the access point itself is not). This modification is completely different from the modification needed to "fix" vulnerable access points (those acting as a repeater or supporting Fast BSS Transitions), so a patch for your access points may or may not prevent attacks against vulnerable clients depending on exactly what type of "fix" the patch contains.

So depending on the capabilities of your access point and which type of patches are available for it, at a minimum you may need to patch only your access point, only your clients, or both in order to defend against this attack. Obviously in the ideal scenario, all vulnerable devices should be patched, regardless of what extra mitigations have been implemented on the access point.

Answer 7

In response to whether patching the AP alone is sufficient:

Reference: WIP patch in 'wpa_supplicant' used in most Linux distros

According to the above commit - it seems possible to prevent the attack by patching only the AP:

This option can be used to work around key reinstallation attacks on the station (supplicant) side in cases those station devices cannot be updated for some reason. By removing the retransmissions the attacker cannot cause key reinstallation with a delayed frame transmission. This is related to the station side vulnerabilities CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, and CVE-2017-13081.

However this is optional, a default build of this module may not have this option enabled.

Based on the other related commits / comments, it appears the best option is to patch the client.

Answer 8

Patching the AP is only needed if the AP acts like a client.

For example:

1. If it supports fast roaming (802.11r).

2. Is part of a mesh (mesh leaf) like in fortinet products

3. Can act like a repeater

4. Supports station-to-station traffic

In these cases the AP should also be patched.

BUT... Patching the AP will also mitigate the attack on unpatched clients that are connecting to this AP (by not sending a zeroed Msg3), so maybe you need to patch the AP in order to protect your clients.

Answer 9

Mathy Vanhoef, the researcher who discovered the KRACK vulnerability and therefore the most authoritative source available on this subject, removed any ambiguity in a video interview for Tech News Weekly:

As a home user, if you've done update on your Windows, and your IOS devices, in that case I would say you're secure.

When you connect to a more enterprise or a more business network, for example a University or a company that has a lot of access points, so a lot of places were the wireless technology is being broadcasted, then there could still be a perk in the equipment that they use.

But, for your home network, if you just update your Windows, or your laptops and your smartphones, then you're already safe.

Moreover, he later added:

Most KRACK attacks against vulnerable clients can be prevented by modifying the router/access point. This may even be possible through AP configuration changes only (without updates). Example is Cisco workarounds. Though this may affect the reliability of handshakes in certain edge cases (e.g. with slow clients or unreliable connections).