I don't quite understand how KRACK is considered a protocol weakness rather than an implementation error.

From reading about KRACK, I found following facts:

  1. There are more vulnerable implementation of WPA.
  2. KRACK can be patch in a backward compatible manner.

If the there exist an implementation that is not vulnerable to KRACK, but is compatible with current WPA2 protocol, shouldn't KRACK be considered an implementation error?

  • 2
    From what I understand an implementation could choose to ignore the part of the protocol that makes it vulnerable while still being fully compatible, but that doesn't mean it isn't part of the protocol. Oct 18, 2017 at 20:24
  • Implementation error means something violates the protocol. In this case it doesnt. Nov 12, 2017 at 17:58

1 Answer 1


It's considered a protocol error rather than an implementation error because the behavior that causes the problem is specifically required by the protocol.

How do you recover when the third step of the four-way handshake gets lost? The standard specifies that it should be done by re-transmission of the packet in question. A system that recovers by re-starting from the beginning would interoperate* with a system that expects recovery by re-transmission, but it wouldn't be compliant with the standard

* A system expecting a re-transmission of a missing packet is going to hold on to the resources for negotiating the connection. If the other system recovers by re-starting, then in a noisy environment there will be many partially-built connections hanging around, with the consequent potential for resource starvation.

  • It is actually the fourth step of the four-way handshake that "gets lost" not the third step. The KRAck Attack uses a MitM position to block message 4, which causes retransmission of message 3. See section 3.2 of the technical write-up: "We use this MitM position to trigger retransmission of message 3 by preventing message 4 from arriving at the authenticator."
    – hft
    Oct 18, 2017 at 22:23
  • @hft, retransmission of the third message can be triggered by loss of either the third or the fourth message: the fourth message is used as confirmation of the arrival of the third message. The attack blocks the fourth message because it needs the third message to arrive twice.
    – Mark
    Oct 18, 2017 at 22:27
  • Maybe so, but the KRACK attack (as described in the paper) only works by blocking message 4. This is because the session key PTK is installed on the victim between message 3 and message 4. By blocking message 4 and then delaying the new message 3 one can collect messages based on the initial PTK. Then the new message 3 can be allowed to go to the victim causing RE-installation of the PTK.
    – hft
    Oct 18, 2017 at 22:32
  • Hence the name of the attack Key RE-installation Attack
    – hft
    Oct 18, 2017 at 22:32
  • @hft delaying is just blocking and then retransmitting, hence the second message 3 is blocked and then retransmitted.
    – user253751
    Oct 19, 2017 at 3:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .