ALERT: WPA isn't necessarily secure

SUMMARY:

WPA-PSK is vulnerable to offline attack.

TO AVOID THE PROBLEM:

USE A PASSPHRASE WITH MORE THAN 20 CHARACTERS. Examples:
BAD: "vintage wine"
GOOD: "floor hiking dirt ocean"
(pick your own words, even longer is better)
FOR HIGH SECURITY, USE MORE THAN 32 CHARACTERS.

BACKGROUND:

Weakness in Passphrase Choice in WPA Interface
By Glenn Fleishman
By Robert Moskowitz
Senior Technical Director
ICSA Labs, a division of TruSecure Corp
<http://wifinetnews.com/archives/002452.html>

...
The offline PSK dictionary attack
...
Just about any 8-character string a user may select will be in the
dictionary. As the standard states, passphrases longer than 20 characters
are needed to start deterring attacks. This is considerably longer than
most people will be willing to use.

This offline attack should be easier to execute than the WEP attacks.
...
Using Random values for the PSK

The PSK MAY be a 256-bit (64 hexadecimal) random number. This is a large
number for human entry; 20 character passphrases are considered too long
for entry. Given the nature of the attack against the 4-Way Handshake, a
PSK with only 128 bits of security is really sufficient, and in fact
against current brute-strength attacks, 96 bits SHOULD be adequate. This is
still larger than a large passphrase ...
...
Summary
...
Pre-Shared Keying is provided in the standard to simplify deployments in
small, low risk, networks. The risk of using PSKs against internal attacks
is almost as bad as WEP. The risk of using passphrase based PSKs against
external attacks is greater than using WEP. Thus the only value PSK has is
if only truly random keys are used, or for deploy testing of basic WPA or
802.11i functions. PSK should ONLY be used if this is fully understood by
the deployers.

See also:
Passphrase Flaw Exposed in WPA Wireless Security
<http://www.technewsworld.com/story/32070.html>

Wi-Fi Protected Access. Security in pre-shared key mode
<http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access>

Cracking Wi-Fi Protected Access (WPA)
<http://www.ciscopress.com/articles/article.asp?p=369221>
<http://www.ciscopress.com/articles/article.asp?p=370636&rl=1>

WPA Cracker
<http://www.tinypeap.com/html/wpa_cracker.html>

John Navas wrote:

>SUMMARY:
>


Bzzt. Excessively repetitive.

John Navas wrote:
SUMMARY:

WPA-PSK is vulnerable to offline attack.

<snip>

See also:
<snip>

WPA Cracker
<http://www.tinypeap.com/html/wpa_cracker.html>

link doesn't work


John

On Mon, 07 May 2007 13:32:00 -0400, John Mason Jr
<notvalid@cox.net.invalid> wrote in
<133uok1cqh3rmc5@news.supernews.com>:

>John Navas wrote:
>SUMMARY:
>
> WPA-PSK is vulnerable to offline attack.
>
><snip>
>
>See also:
><snip>
>
> WPA Cracker
> <http://www.tinypeap.com/html/wpa_cracker.html>
>
>link doesn't work

http://www.google.com/search?q=wpa-cracker

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>

John Navas wrote:
> On Mon, 07 May 2007 13:32:00 -0400, John Mason Jr
> <notvalid@cox.net.invalid> wrote in
> <133uok1cqh3rmc5@news.supernews.com>:
>
>> John Navas wrote:
>> SUMMARY:
>>
>> WPA-PSK is vulnerable to offline attack.
>>
>> <snip>
>>
>> See also:
>> <snip>
>>
>> WPA Cracker
>> <http://www.tinypeap.com/html/wpa_cracker.html>
>>
>> link doesn't work
>
> http://www.google.com/search?q=wpa-cracker
>

I just figured you might want to post a working link in your FAQ, and
may not have realized the link was broken

John

On Tue, 08 May 2007 01:08:50 GMT, John Navas
<spamfilter1@navasgroup.com> wrote:

>On Mon, 07 May 2007 13:32:00 -0400, John Mason Jr
><notvalid@cox.net.invalid> wrote in
><133uok1cqh3rmc5@news.supernews.com>:
>
>>John Navas wrote:
>>SUMMARY:
>>
>> WPA-PSK is vulnerable to offline attack.
>>
>><snip>
>>
>>See also:
>><snip>
>>
>> WPA Cracker
>> <http://www.tinypeap.com/html/wpa_cracker.html>
>>
>>link doesn't work
>
>http://www.google.com/search?q=wpa-cracker


AirCrack-NG
<http://www.aircrack-ng.org>
<http://www.wirelessdefence.org/Contents/Aircrack-ng_WinMain.htm>

Specifically for an offline dictionary attack on WPA see:
<http://www.wirelessdefence.org/Contents/Aircrack-ng_WinAircrack.htm#Breaking_WPA:>

--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558 jeffl@comix.santa-cruz.ca.us
# http://802.11junk.com jeffl@cruzio.com
# http://www.LearnByDestroying.com AE6KS

On Thu, 10 May 2007 17:47:49 -0400, John Mason Jr
<notvalid@cox.net.invalid> wrote in
<13474o6n7k93g52@news.supernews.com>:

>John Navas wrote:
>> On Mon, 07 May 2007 13:32:00 -0400, John Mason Jr
>> <notvalid@cox.net.invalid> wrote in
>> <133uok1cqh3rmc5@news.supernews.com>:
>>
>>> John Navas wrote:
>>> SUMMARY:
>>>
>>> WPA-PSK is vulnerable to offline attack.
>>>
>>> <snip>
>>>
>>> See also:
>>> <snip>
>>>
>>> WPA Cracker
>>> <http://www.tinypeap.com/html/wpa_cracker.html>
>>>
>>> link doesn't work
>>
>> http://www.google.com/search?q=wpa-cracker
>
>I just figured you might want to post a working link in your FAQ, and
>may not have realized the link was broken

Thanks for your concern, but broken links are inevitable, and there
aren't enough hours in the day to keep checking and fixing them.

--
Best regards, FAQ for Wireless Internet: <http://Wireless.wikia.com>
John Navas FAQ for Wi-Fi: <http://wireless.wikia.com/wiki/Wi-Fi>
Wi-Fi How To: <http://wireless.wikia.com/wiki/Wi-Fi_HowTo>
Fixes to Wi-Fi Problems: <http://wireless.wikia.com/wiki/Wi-Fi_Fixes>