Is it possible to speed up WPA/WPA2-PSK cracking using a rogue AP?

Question

We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related page on Wikipedia:

The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. The product is then put through a cryptographic hash function.

So, if an attacker has the ability to setup a rogue AP (Access point) and make some clients automatically deauth & connect (especially mobile clients) to that rogue AP of his, can he gain some advantage to speed up calculations for cracking the PSK by introducing some specially generated inputs for example ANonce, AP MAC -the variables which he can control-?

We can assume that he has the chance to do this for some reasonable times such as 10. So he will obtain that number of 4-way handshakes which he used some specially selected inputs (similar to a chosen-plaintext attack). I wonder if there is some component in the design which will prevent that he gains some speed advantage by using a rogue AP rather than simply capturing the 4-way handshakes?

Answer 1

The key derivation of the PTK is defined in section 8.5.1.2 of IEEE 802.11-2007, Figure 8-20 (page 198, which is page 247 in the PDF file):

PRF-X(PMK, "Pairwise key expansion",
      Min(AA,SPA) || Max(AA,SPA) ||
      Min(ANonce,SNonce) || Max(ANonce,SNonce))

AA and SPA are the addresses of both communicating partners, ANonce and SNonce are the nonces sent by them.

X is the number of bits needed, and depending on the use, X is here either 384 or 512.

In the previous section 8.5.1.1, the PRF (pseudo-random function) is defined, and it is effectively

PRF-X(K, A, B) = HMAC-SHA-1(K, A || 0 || B || 1) ||
                 HMAC-SHA-1(K, A || 0 || B || 2) ||
                 ...

(with as many repetitions as needed to fill the needed number of bits, discarding the remaining ones.)

So the question effectively is: Can one attack HMAC-SHA-1 in a way that, knowing some of the input and choosing other parts of the input, but not knowing the key, one can (a) derive parts of the output, or (b) derive the key?

As far as is known, neither the HMAC construction nor the SHA-1 hash function has a weakness in this respect.

So the only currently known way to break this would be to brute-force the PSK (or the password from which it is derived), which would need not much more than one listened handshake, but lots of computation to find the key.

There is no realistic chance to break the 256-bit key, but one might find a password from which it is derived quite easier. So use a good password.

Answer 2

If a user has connected before, their client should complain if the MAC address of the AP has changed and warn the user about connecting. Under windows it will forcibly append "2" to the ap name. This should reduce the likelihood of success. However, if the MAC address is the same, the client will have no way of knowing if the AP is rouge. This means that you could have a hard-coded ANonce value which would reduce the key space that has to be searched. If you where brute forcing the offset one handshake would reduce the number of permutations to the size of the SNonce.

Answer 3

Although difficult, obtaining a WPA2 password via a rogue AP is theoretically possible.

One would create an AP with a different MAC so that you don't deauth yourself but the same ESSID.

A web server running on this AP combined with some iptables rules would reroute all http traffic to a locally served web page that allows the users to enter their password.

Since the Vendor and model of the router can often be found using a network sniffer such as wireshark, one could make a fairly convincing "Firmware Update" page.

The webpage could POST the password to a mysql database.

The only thing left is incentive to connect to a strange open AP with the same name as his own AP. Using another wireless interface, one can use a deauth attack against all clients connected to the original AP.

Clients will get frustrated and will want their internet back which could lead to them checking available networks and seeing the rogue one.

Their are a lot of variables:

• Signal strength of Rogue AP
• Deauth being able to reach clients at all locations.
• Victim is desperate enough to check available networks and connect
• Victim navigates to http page
• Victim is desperate/dumb enough to enter password in a web page.

But it is not impossible.