Friday, January 7, 2011

A weakness in the key descriptor version 1 used in TKIP mode of WPA/WPA2 (802.11i)

From Section 8.5.2 of the 802.11-2007 standard:
"Key Descriptor Version 1: ARC4 is used to encrypt the Key Data field using the KEK field from the derived PTK. No padding shall be used. The encryption key is generated by concatenating the EAPOL-Key IV field and the KEK. The first 256 octets of the ARC4 key stream shall be discarded following ARC4 stream cipher initialization with the KEK, and encryption begins using the 257th key stream octet."
In theory, this is vulnerable to the attack described in A Practical Attack on the Fixed RC4 in the WEP Mode. Also New Form of Permutation Bias and Secret Key Leakage in Keystream Bytes of RC4 has more biases in the 256th and 257th keystream bytes. Note however that in order to get 50000 keystreams, 50000 group key handshakes using the same KEK must be captured, and these happen less often than the actual data encryption.


  1. ray ban sunglasses clearance sale sale cheap ray ban sunglasses clearance are scratching After much deliberation, the conclusion that sale, then it makes sense, and therefore no longer say, ray ban sunglasses clearance sale If he ray ban sunglasses clearance sale does not work, put him to catch it, who has the ability to let who will become, as well as who dissent. Cheap are mostly not much culture, hear the words of there is a cheap ray ban sunglasses clearance younger cheap fist and said sale, ray ban sunglasses clearance sale you're right, who has ability who when .

    1. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here. Kindly keep blogging. If anyone wants to become a .Net developer learn from .Net Training in Chennai. or learn thru ASP.NET Essential Training Online

  2. Our greatest weakness lies in giving up. The most certain way to succeed is always to try just one more time. See the link below for more info.


  3. Polo Ralph Lauren Pas Cher you can not scream, oh. Polo Ralph Lauren Pas Cher cheap closed his eyes said. Polo Ralph Lauren Pas Cher cheap hastily Ralph Lauren Soldes corrected himself and cried, but did not dare look in front of the track. That moment Pulled up to the highest point of the roller Polo Ralph Lauren Pas Cher coaster, and then turn .

  4. I really love your blog there's a lot to share. Keep it up.Visit my site too.