[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4

To: cpunks <[email protected]>, Discussion of cryptography and related <[email protected]>
Subject: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
From: [email protected] (coderman)
Date: Mon, 15 Sep 2014 02:39:15 -0700
In-reply-to: <CAJVRA1Sxg_VJ1JO2G0+fKBfcEdMEJULsrp7-Q_OcmVFHEwza0Q@mail.gmail.com>
References: <CAJVRA1Sxg_VJ1JO2G0+fKBfcEdMEJULsrp7-Q_OcmVFHEwza0Q@mail.gmail.com>

On 9/15/14, coderman <[email protected]> wrote:
> ... every implementation of WPA2 that i have tested is vulnerable to
> an active downgrade to TKIP/RC4 while still being "WPA2" and still
> showing all signs of using strongest security settings.

yes, this attack does require knowing the WPA passphrase (PSK) and no
i have not looked at WPA-Enterprise mode (EAP-*).

yes, just looking for populated michael MIC authenticator fields is
probably sufficient to alarm if you've configured WPA2 only.

yes, this is all for now. :)

best regards,

Follow-Ups:
- RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
  - From: [email protected] (coderman)

References:
- RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
  - From: [email protected] (coderman)

Prev by Date: Fwd: RFC 7359 on Layer 3 Virtual Private Network (VPN) Tunnel Traffic Leakages in Dual-Stack Hosts/Networks
Next by Date: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
Previous by thread: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
Next by thread: RC4 is dangerous in ways not yet known - heads up on near injection WPA2 downgrade to TKIP RC4
Index(es):
- Date
- Thread