I don't quite understand how KRACK is considered a protocol weakness rather than an implementation error.

From reading about KRACK, I found following facts:

  1. There are more vulnerable implementation of WPA.
  2. KRACK can be patch in a backward compatible manner.

If the there exist an implementation that is not vulnerable to KRACK, but is compatible with current WPA2 protocol, shouldn't KRACK be considered an implementation error?

  • 2
    From what I understand an implementation could choose to ignore the part of the protocol that makes it vulnerable while still being fully compatible, but that doesn't mean it isn't part of the protocol. – AndrolGenhald Oct 18 '17 at 20:24
  • Implementation error means something violates the protocol. In this case it doesnt. – Smit Johnth Nov 12 '17 at 17:58

It's considered a protocol error rather than an implementation error because the behavior that causes the problem is specifically required by the protocol.

How do you recover when the third step of the four-way handshake gets lost? The standard specifies that it should be done by re-transmission of the packet in question. A system that recovers by re-starting from the beginning would interoperate* with a system that expects recovery by re-transmission, but it wouldn't be compliant with the standard

* A system expecting a re-transmission of a missing packet is going to hold on to the resources for negotiating the connection. If the other system recovers by re-starting, then in a noisy environment there will be many partially-built connections hanging around, with the consequent potential for resource starvation.

  • It is actually the fourth step of the four-way handshake that "gets lost" not the third step. The KRAck Attack uses a MitM position to block message 4, which causes retransmission of message 3. See section 3.2 of the technical write-up: "We use this MitM position to trigger retransmission of message 3 by preventing message 4 from arriving at the authenticator." – hft Oct 18 '17 at 22:23
  • @hft, retransmission of the third message can be triggered by loss of either the third or the fourth message: the fourth message is used as confirmation of the arrival of the third message. The attack blocks the fourth message because it needs the third message to arrive twice. – Mark Oct 18 '17 at 22:27
  • Maybe so, but the KRACK attack (as described in the paper) only works by blocking message 4. This is because the session key PTK is installed on the victim between message 3 and message 4. By blocking message 4 and then delaying the new message 3 one can collect messages based on the initial PTK. Then the new message 3 can be allowed to go to the victim causing RE-installation of the PTK. – hft Oct 18 '17 at 22:32
  • Hence the name of the attack Key RE-installation Attack – hft Oct 18 '17 at 22:32
  • @hft delaying is just blocking and then retransmitting, hence the second message 3 is blocked and then retransmitted. – immibis Oct 19 '17 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.