0

Like I asked in the thread title; Will the new WPA3 protocol make it impossible to hack a WIFI's password using tools like aircrack-ng?

Improve this question
3
  • 1
    Well, I suppose this will be one of the goals of the protocol designers. However, only time will tell, if it is impossible, or rather practically unfeasible.
    – Euphrasius von der Hummelwiese
    Apr 10, 2019 at 11:08
  • 3
    As if on cue: wpa3.mathyvanhoef.com
    – Royce Williams
    Apr 10, 2019 at 16:01
  • Define the level of resources an attacker has, the level of security-awareness of the target, and the timeframe for the attack
    – Don Simon
    Apr 10, 2019 at 21:40

2 Answers 2

Reset to default
4

Nothing is impossible

Well, sort of. In the world of information security, words like "impossible" are frowned upon. It's comparatively easy to prove that you can do something, but very difficult to prove that nobody else can do something.

Can the NSA...

As with any good crypto, someone sooner or later will ask if the alphabet soup agencies can "crack" it. The answer is most of the time either "Yes" or "We don't know", because it's extremely difficult to prove without any doubt that it's impossible for them to do it. Of course, we have indicators such as "They are using it themselves. If it was crackable, they wouldn't use it", but this is just an indicator, not a solid proof.

Neglectably small chances...

Think of a number between 0x00 and 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF. What are the chances of me guessing this number? You might say it's impossible, but not quite. It's just very, very, very unlikely for me to guess it. In fact, I could rent out all of Amazon to make guesses and I would likely not guess your number correctly within the remaining lifespan of the universe.

This is what cryptographers generally refer to as a "neglectably small chance".

So what about WPA-3?

As with any new protocol, it's hard to judge how we will view it in 10 or 20 years. Sometimes cryptoanalysts take years and years to find theoretical flaws that would make theoretical attacks faster (at least in theory). If a protocol undergoes proper review by experts, then glaring flaws will likely be found far before anyone actually writes any piece of code, and the protocol gets improved.

As for implementation, it's a far different story. There are many ways to screw up an implementation. Not making boundary checks, not adhering to the standard, assuming that someone is going to act a certain way, etc.

Luckily, implementation errors are more or less easily fixable, while errors in protocols are not, as seen with BadUSB.

To summarize, we probably will not be able to call it "impossible to crack", but rather "the chance to crack is neglectably small" (unless someone screws up with the implementation).

What about WPA 2?

WPA 2 is not as insecure as many people believe. In fact, if you use a strong password, then the chance of an attacker being able to crack it is...well...neglectably small.

Improve this answer
1

WPA3 have better security than WPA2. The biggest issue of WPA2 was it was succeptible to brute force password attack. The handshake is captured and attacker uses an offline dictionary attack. If password is not so strong, then attacker might get the passphrase. The other issues where related to sniffing in public Wi-Fi and insecurity of WPS when using to connect user input interface less devices.

1) Attacker sniffing traffic.

The OWE encrypts each individual connection. So sniffing traffic is made more difficult.

2) Password brute force attack.

The SAE used in WPA3 prevents dictionary attack. It have forward secrey. So even if handshake is captured password offline brute force is not possible. This make password cracking very difficult.

3) WPS attack

Wi-Fi Easy connect replaces WPS for connecting devices. Wi-Fi Easy Connect incorporates strong encryption through public key cryptography to ensure networks remain secure as new devices are added.​

The protocol developers have taken good amount of effort in making the new protocal secure. However we need to see how long this protocol can see remain secure.

Edit Just today 10 April 2019 in one of the implementation of WPA3 security bug were released publicly.

One a potential side channel attacks in SAE implementation.

https://w1.fi/security/2019-2/eap-pwd-side-channel-attack.txt

Denial of service attack.

https://w1.fi/security/2019-3/sae-confirm-missing-state-validation.txt

Bugs are always expected to come and developers are always fighting against it.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .