Security flaws of the WEP-Protocol by Bastian Sopora, Seminar Computer Security 2006

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

Wireless Networking ALOHAnet ALOHAnet 1997: IEEE (IR) 1997: IEEE (IR) 1999: IEEE b (11Mbps) 1999: IEEE b (11Mbps) 2003: IEEE g (54Mbps) 2003: IEEE g (54Mbps) 2007: IEEE n (540Mbps) 2007: IEEE n (540Mbps)

The need for security Why do we need the WEP-Protocoll? Why do we need the WEP-Protocoll? Wi-Fi networks use radio transmissions Wi-Fi networks use radio transmissions  prone to eavesdropping Mechanism to prevent outsiders from Mechanism to prevent outsiders from accessing network data & traffic accessing network data & traffic using network resources using network resources

IEEE reactions 1999: Wired Equivalent Privacy (WEP) 1999: Wired Equivalent Privacy (WEP) 2003: WiFi Protected Access (WPA) 2003: WiFi Protected Access (WPA)

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

WEP – the basic idea WEP = Wired Equivalent Privacy WEP = Wired Equivalent Privacy As secure as a wired network As secure as a wired network Part of the IEEE standard Part of the IEEE standard

WEP – how it works Encrypt all network packages using Encrypt all network packages using a stream-cipher (RC4) for confidentiality a stream-cipher (RC4) for confidentiality a checksum (CRC) for integrity a checksum (CRC) for integrity

WEP – different flavors Originally (1999) 64 bit: Originally (1999) 64 bit: Legal limits Legal limits 24 bit Initialization Vector (IV) 24 bit Initialization Vector (IV) 40 bit key 40 bit key 128 bit: 128 bit: 104 bit (26 Hex-Characters) key 104 bit (26 Hex-Characters) key 256 bit: 256 bit: 232 bit key 232 bit key Available, but not common Available, but not common

Small steps? Evolution of WEP to WEP128 to WEP256: Initialization Vector remains at 24 bit Initialization Vector remains at 24 bit Encryption key size increases Encryption key size increases

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

The major flaw A Stream-Cipher should never use the same key twice A Stream-Cipher should never use the same key twice

The Stream-Cipher-Breakdown E(A) = A xor C [C is the key] E(A) = A xor C [C is the key] E(B) = B xor C Compute E(A) xor E(B) Compute E(A) xor E(B) xor is commutative, hence: E(A) xor E(B) = A xor C xor B xor C = A xor B xor C xor C = A xor B

The major flaw A Stream-Cipher should never use the same key twice... A Stream-Cipher should never use the same key twice......or else we know A xor B, which is relatively easy to break...or else we know A xor B, which is relatively easy to break if both messages are in a natural language. if both messages are in a natural language.or if we know one of the messages. if we know one of the messages.

The WEP-repetition For a 24 bit Initialization Vector, there is a 50% chance of repetition after 5000 packets... For a 24 bit Initialization Vector, there is a 50% chance of repetition after 5000 packets...

The Theory Fluhrer, Mantin, and Shamir wrote a paper on the WEP weakness in the RC4 implementation... Cornell University “ “Weaknesses in the Key Scheduling Algorithm of RC4“

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

Feasibility of attack Practical Practical Cheap Cheap Easy Easy Fast Fast

Feasibility of attack Practical Practical Cheap Cheap Easy Easy Fast Fast WEP Users: time to panic! WEP Users: time to panic!

How to do it... Stubblefield, Ioannidis, and Rubin wrote a paper about the implementation in 2001 Stubblefield, Ioannidis, and Rubin wrote a paper about the implementation in 2001 Rice University & AT&T Rice University & AT&T “Using the Fluhrer, Mantin, and Shamir Attack to Break WEP” “Using the Fluhrer, Mantin, and Shamir Attack to Break WEP” Only six pages! Only six pages!

How to do it... Collect packets (about 6m for WEP128) Collect packets (about 6m for WEP128) Only observe the first byte Only observe the first byte Depends on only 3 values Depends on only 3 values (S[1], S[S[1]], S[S[1]+S[S[1]]) May be known plaintext (“0xAA“) May be known plaintext (“0xAA“) Try guessing the key, byte by byte Try guessing the key, byte by byte chance of 1/20 per byte chance of 1/20 per byte

How WE do it... Aircrack-ng Aircrack-ng Available freely for Linux, Windows and certain PDAs Available freely for Linux, Windows and certain PDAs Only requires about 1m packets for WEP128 Only requires about 1m packets for WEP128

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

Outlook for WEP WEP2 WEP2 Enlarged IV Enlarged IV enforced 128-bit encryption enforced 128-bit encryption WEP+ WEP+ Only use strong IVs Only use strong IVs has to be used on both ends has to be used on both ends...a dead end...

Outlook for WEP WEP2 WEP2 No change in concept, just more packets needed No change in concept, just more packets needed WEP+ WEP+ How does one enforce the client side? How does one enforce the client side?...a dead end...

Alternatives WPA, WPA2, 802.1X WPA, WPA2, 802.1X 48 bit IV, mutate key after certain time 48 bit IV, mutate key after certain time Depend on an authentication server Depend on an authentication server IPsec, VPN IPsec, VPN Tunneling and secure wrapping of packets Tunneling and secure wrapping of packets

Agenda Introduction Introduction Basics of the WEP-Protocol Basics of the WEP-Protocol Weaknesses of WEP Weaknesses of WEP Breaking WEP Breaking WEP Alternatives & Outlook Alternatives & Outlook Summary & Discussion Summary & Discussion

Summary: WEP WEP is not secure! WEP is not secure! Faulty implementation of RC4 Faulty implementation of RC4 Developing an attack was easy Developing an attack was easy A successful attack only needs: A successful attack only needs: Off-the-shelf hardware (Laptop, Prism2) Off-the-shelf hardware (Laptop, Prism2) Free software Free software A very short time (a few days at most) A very short time (a few days at most)