Falsification Attacks against WPA-TKIP in a Realistic Environment

Todo Yosuke

Ozawa Yuki

Ohigashi Toshihiro

Morii Masakatu

IEICE Transactions on Information and Systems

In this paper, we propose two new falsification attacks against Wi-Fi Protected Access Temporal Key Integrity Protocol (WPA-TKIP). A previous realistic attack succeeds only for a network that supports IEEE 802.11e QoS features by both an access point (AP) and a client, and it has an execution time of 12-15min, in which it recovers a message integrity code (MIC) key from an ARP packet. Our first attack reduces the execution time for recovering a MIC key. It can recover the MIC key within 7-8min. Our second attack expands its targets that can be attacked. This attack focuses on a new vulnerability of QoS packet processing, and this vulnerability can remove the condition that the AP supports IEEE 802.11e. In addition, we discovered another vulnerability by which our attack succeeds under the condition that the chipset of the client supports IEEE 802.11e even if the client disables this standard through the OS. We demonstrate that chipsets developed by several kinds of vendors have the same vulnerability.

wireless LAN network

WPA-TKIP

falsification attack

QoS

vulnerability

General works [ 000 ]

eng

一般社団法人電子情報通信学会

Copyright (c) 2012 The Institute of Electronics, Information and Communication Engineers

[ISSN] 0916-8532

[DOI] 10.1587/transinf.E95.D.588

[NCID] AA10826272

[DOI] http://dx.doi.org/10.1587/transinf.E95.D.588