As I understand it, when exploited against Linux and Android the KRACK attack results in the encryption key for the session being zeroed out on the device, so an eavesdropper can easily decrypt the messages. On other platforms, this doesn't happen, so the encryption key can't be determined.

For encryption to work, both parties must have agreed on the same key, but the attack has changed the encryption key on the client (to all zero) but not the AP (which continues to use the originally negotiated key). Surely this means that the two parties won't be able to understand each other, so there would be 100% packet loss resulting in the connection being dropped fairly quickly, before much (if any) sensitive data can be transmitted.

1 Answer 1


KRACK is a man-in-the-middle attack. That is: the access point is not disturbed, only the station, or the computer connecting to it. For instance, a good reference is [1].

It seems that KRACK was not faithfully presented, even in the specialized media.It is a very clever attack, and some misconceptions have been repeatedly presented: for instance, computers running Microsoft Windows are not safe from it, as it is a failure in the WPA2 specification, not a failure in its Linux kernel implementation.It is true that computers with a Linux kernel were weaker under this attack, but no computer was really safe.

[1]: Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2

  • It's a very good starting point but it would be lovely to explain it a little more instead of the paper ( which is a lot to read and understand ). To my understanding KRACK means that you as MITM catch the traffic from the device with the encrypted data ( zeroed key ) and send it to the AP with the original key. Or am I wrong? That way you could temper the data and read everything.
    – Nico
    Nov 6, 2017 at 7:02
  • It doesn't seem to specify in the paper (I haven't read it thoroughly, but I can't see any details of the wpa_supplicant attack beyond those given in section 6.3). Would I be right in saying then that a typical attack would be: let the device start connecting to the legitimate AP, then trick it into switching to the malicious ap and resending message 3 of the handshake, so the client is now communicating directly with the malicious AP (and not the legitimate AP at all), using a zero encryption key to the malicious AP can understand it. The client thinks it's talking to the legitimate one.
    – JackW
    Nov 6, 2017 at 18:53
  • Hello, @Nico and JackW, I think we all need to understand WPA2 a little more. I will try to present a more intuitive discussion of the paper in the next days. Thanks for your incentive. Nov 8, 2017 at 2:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .