bk99.de entertain the web since 1997

bk99.de
Mathy Vanhoef · Radio & mobile networksCurated

Dragonblood: weaknesses in WPA3

Summary

In April 2019 Mathy Vanhoef and Eyal Ronen published attacks under the name Dragonblood against WPA3’s Dragonfly handshake, which was supposed to make password guessing impossible. Through downgrade attacks and timing and cache side channels, attackers within radio range could still recover the Wi-Fi password. The Wi-Fi Alliance responded with recommendations, which according to Vanhoef themselves proved hard to implement securely.

What Dragonblood showed

WPA3 was meant to rule out offline dictionary attacks with the Dragonfly handshake, also called SAE. Vanhoef and Ronen found two classes of weaknesses: in transition mode, which allows WPA2 and WPA3 devices side by side, a client can be downgraded to WPA2. And the computation in the handshake leaks enough through timing and cache access to guess the password.

Dragonfly is also part of EAP-pwd, a method for corporate networks; there the researchers found bugs in most products that allowed logging in as any user without a password. Later they showed that the Brainpool curves recommended by the Wi-Fi Alliance open new side channels too.

Ideas

  • A new standard is not automatically secure.
  • Transition modes for old devices are gateways.
  • Side channels leak secrets through timing and memory access.
  • Recommendations without public review repeat old mistakes.

Insights

  • Dragonblood repeats the lesson of KRACK: a standard developed behind closed doors is only thoroughly reviewed after adoption, when fixes are expensive.
  • For everyday use WPA3 is still progress, provided devices are up to date and transition mode is not left running permanently.

Facts

  • Published in April 2019 by Mathy Vanhoef (NYU Abu Dhabi) and Eyal Ronen (Tel Aviv University and KU Leuven).
  • Attack classes: downgrade in transition mode and timing and cache side channels.
  • EAP-pwd is affected too; most implementations examined had bugs.

References

Remarks

  • The page was updated several times; the paper appeared at the IEEE Symposium on Security and Privacy.

Recommendations

  • Only run WPA3 with current drivers and firmware.
  • Use transition mode only as long as old devices require it.
  • Use long, random Wi-Fi passwords so that dictionary attacks also come to nothing.

Read the original page

Search the Web Archive

Mathy Vanhoef · 2017

KRACK: WPA2 becomes vulnerable

On 16 October 2017 Mathy Vanhoef of KU Leuven published the Key Reinstallation Attacks, KRACK for short, against the four-way handshake of WPA2. An attacker within radio range can make victims reinstall an already used key and thus read and partly manipulate encrypted traffic. The weakness lay in the standard itself, so practically all Wi-Fi devices were affected, most severely Linux and Android from version 6.0.

CCC · 2024

Building your own LoRa mesh network

WillCrash leads from LoRa and ESP nodes through antenna choice and site planning to a robust mesh network that communicates independently of conventional infrastructure. Independent communication comes more from a good topology than from particularly expensive hardware.

HN · 2019

Linux-based 4G phones for seven dollars

TuxPhones describes KaiOS devices that combine web technologies on cheap hardware with keypad operation, mobile connectivity and long battery life. KaiOS is based on Linux and Gecko components.