-3

I have downloaded the following function from the internet. It's a WEP Key generator for 64-bit from a giving passphrase. and I m wondering if a such algorithm is a standard algorithm? or it's an algorithm invented by the developer?

void wepkey64(char *passphrase, unsigned char k64[4][5])
{
    unsigned char pseed[4] = {0};
    unsigned int randNumber, tmp;
    int i, j;

    for(i = 0; i < strlen(passphrase); i++)
    {
        pseed[i%4] ^= (unsigned char) passphrase[i];
    }

    randNumber = pseed[0] | (pseed[1] << 8) | (pseed[2] << 16) | (pseed[3] << 24);

    for (i = 0; i < 4; i++)
    {
        for (j = 0; j < 5; j++)
        {
            randNumber = (randNumber * 0x343fd + 0x269ec3) & 0xffffffff;
            tmp = (randNumber >> 16) & 0xff;
            k64[i][j] = (unsigned char) tmp;
        }
    }
}
2
  • 1
    Please don't cross-post the exact same question in two or more SE sites, even if it would be on-topic on both. See this FAQ entry for more details. Thank you
    – mgibsonbr
    May 9, 2013 at 10:47
  • Welcome to Information Security! Not really sure what you hope to achieve from this question, please see the FAQ and How to Ask. Regardless, DO NOT USE WEP, it is quite broken and considered very insecure.
    – AviD
    May 9, 2013 at 11:36

1 Answer 1

2

WEP was one of the first protocols which tried to secure the wireless networks. It was a part of IEEE 802.11 standards. It was cracked almost a decade back and rarely seen these days.For details on how it worked and its vulnerabilities you may see this

WEP made use of RC4 stream cipher for encryption.The problem with RC4 is if the same key stream was used repeatedly it becomes very easy to crack the key by sniffing enough number of packets and carrying out a passive attack (dictionary attack). The concept of Initialization Vector (IV) was used to make sure that the key streams are not repeated. 24 bits of IVs were added to the key to make it random.

So now

64 bit WEP key = 40 bits key stream + 24 bits of IV

The biggest problem was that the IV length was too small (In a busy network the IV will be repeated) and the 802.11 standards did not specify how to generate the IV. So basically it was left to the vendors to generate the pseudo-random IVs.I think that answers your question.

Nowadays, WPA2 is used.It uses better encryption and has two flavors personal (for home use) and enterprise (an authentication server is used and there is no single passkey shared among multiple users). for details see this and this

Not the answer you're looking for? Browse other questions tagged .