When a client is forced to reinstall the key and to reset the nonce and the replay counter, what does it imply for the future communication between the client and the AP? There's an adversary in the MITM position who now can decrypt packets, but I'm wondering if the client can still communicate with the AP (and with the Internet) provided that adversary forwards packets in both directions.

As I understand it, the AP's replay counter won't be reset, and therefore it will refuse any packets with number lower than its replay counter. Also, the AP will assume that it is receiving data encrypted with keystream from nonce X, but because of the attack and the client's nonce reset, it will receive data encrypted with keystream from nonce 0.


1 Answer 1


The KRACK paper states:

We first establish a man-in-the-middle (MitM) position between the supplicant and authenticator.


A second minor obstacle is that we must obtain a MitM position between the client and AP. This is not possible by setting up a rouge AP with a different MAC address, and then forwarding packets between the real AP and client. Recall from Section 2.3 that the session key is based on the MAC addresses of the client and AP, meaning both would derive a different key, causing the handshake and attack to fail. Instead, we employ a channel-based MitM attack, where the AP is cloned on a different channel with the same MAC address as the targeted AP. This assures the client and AP derive the same session key.

(Emphasis mine)

From what that section of the paper says, there is a MITM between the supplicant (client) and the authenticator (AP). Furthermore, there is a diagram on the paper (page 6) which shows the MITM connection involving the supplicant, adversary and authenticator:

MITM Diagram

The paper also mentions how the authenticator will accept any replay counter:

However, a careful inspection of the 802.11 standard reveals that the authenticator may accept any replay counter that was used in the 4-way handshake, not only the latest one.

  • According to the paper, authenticator may accept any replay counter used in the 4-way handshake, but not in data packets. For example, in the diagram above, authenticator receives Enc(2)(ptk){Msg4(r+2)} and then Enc(1)(ptk){Data}. It receives packet with nonce 1 after packet with nonce 2. Should't this cause problems? Oct 17, 2017 at 19:16
  • I believe this is because some APs accept an older replay counter which was used in a message to the client, but not used as a reply from the client to the AP. In the diagram above that's exactly what is happening - replay counter r + 1 is sent from the AP to client, but not sent back to the AP from the client so that older replay counter can be used.
    – Joe
    Oct 17, 2017 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .