1

enter image description here

Brute force attack against WPA is the most common attack against WPA/WPA2 networks. Attacker captures the 4-way handshake that allows the authentication key to be cracked offline.

During the 4-way handshake, several pieces of information are required:

  • SSID
  • The key (not directly present in the exchanges)
  • The MAC address of the two parties
  • The nonce

The attacker can capture the challenge and the result and this allows the PMK to be deduced via a dictionary brute force attack. In particular, since PTK=F(PMK,Anonce,Snonce,APMacAddr,STAMacAddr), the attacker bruteforces PMK until finds a PTK which is coherent to the challenge-response(MIC)....

BUT, my doubt is, since the MIC is performed by using HALF of the PTK (this half is the so called KCK), then how is it possible for the attacker to find the FULL PTK?

Improve this question

1 Answer 1

Reset to default
1

It's true that the MIC is derived only from the KCK and not the entire PTK. However, the size of the MIC is 128 bits. Due to the collision resistance of the algorithms involved, it's practically impossible to encounter different PSKs where the MICs share all 128 bits. So the MIC comparison is enough to verify the correctness of the PSK. Note that this is by design. If the MIC wasn't sufficient, then the client and AP would have the same problem as the attacker in your scenario: They couldn't be sure that the other party actually has the PSK. To prevent this case, the protocol designers made the MIC long enough to rule out collisions.

If the MIC was a lot shorter, then this would indeed be a problem both for a brute-force attack and the protocol itself.

Improve this answer
4
  • thanks. the reason can be this? probability of generating that specific MIC using KCK of 128 bits: 1/2^128. total number of PTK keys ending in the same 128 bits of KCK: 2^128 (since PTK length is 128*2). =>number of possible PTK to generate that MIC = 2^128 / 2^128 = 1
    – allexj
    Commented Jun 23 at 21:55
  • This calculation doesn’t make sense. For an exact result, you’d have to start at the passphrase or PSK and calculate the probability of getting a PTK with a particular KCK. However, if you only want to look at the last step, then the probability of ending up with a particular KCK is 2^(512 – 128) / 2^512 = 2^(-128). Note that a PTK is 512 bits long (not 256) and contains 5 subkeys (KCK, KEK, TK, MIC Tx, MIC Rx).
    – Ja1024
    Commented Jun 24 at 3:35
  • PTK is 512 bits and KCK is 128? I read that KCK has PTK/2 length..
    – allexj
    Commented Jun 24 at 15:07
  • This is incorrect. See section 8.5.1.2 of IEEE 802.11i-2004: The PTK is divided into the KCK (128 bits), the KEK (128 bits) and the Temporal Key TK (256 or 128 bits). In the case of TKIP, the TK is 256 bits long (with further subkeys), so the lotal length of the PTK is 128 + 128 + 256 = 512 bits. In the case of CCMP, the TK is 128 bits long, leading to a total PTK length of 384 bits.
    – Ja1024
    Commented Jun 24 at 15:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .