Slashdot Mirror
Researchers Crack WPA Wi-Fi Encryption
narramissic writes "Researchers Erik Tews and Martin Beck 'have just opened the box on a whole new hacker playground, says Dragos Ruiu, organizer of the PacSec conference. At the conference, Tews will show how he was able to partially crack WPA encryption in order to read data being sent from a router to a laptop. To do this, Tews and Beck found a way to break the Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively short amount of time: 12 to 15 minutes. They have not, however, managed to crack the encryption keys used to secure data that goes from the PC to the router in this particular attack. 'Its just the starting point,' said Ruiu."
Is AES not the more secure of the two? From everything I have read, AES is the preffered option over TKIP.
I recall seeing some AP setups where TKIP was the default scheme.
In the wide spectrum of Luddite to Novice to Hobbyist to Professional there are probably a bunch of users that might know enough to use WPA (perhaps from prodding from friends) and use the default settings with a key (either random or a passphrase).
Valid question.
Well, if a story comes from the firehose, it gets tagged "story", because it became a story. And If it didn't, it gets tagged "!story".
Any sufficiently advanced intelligence is indistinguishable from stupidity.
In short, yes, AES is more secure than TKIP.
WPA and TKIP was really just a stepping stone to get people off WEP and heading toward WPA2 and AES. Wireless hardware built to run WEP didn't have the processing power to run AES (I think it needed a separate crypto processor just for AES). So they made the WPA standard run TKIP so current WEP hardware was able to use a better security setup. It was all intended to move everyone to WPA2 with AES after everyone had bought newer wireless cards and routers.
Interestingly, this means if you have hardware that only supports WEP, and the vendor doesn't offer WPA support, it's because they are too lazy to implement it (or want you to buy the new stuff). The hardware can handle it, they just need to add it to the firmware. My work had some handheld units like this. We had to buy all new units.
TKIP is not a cipher; it is a keying protocol. When you use TKIP, the actual cipher you are using is called RC4, which is older and has more known vulnerabilities than AES. It is also the cipher typically used by WEP, though the keying protocol WEP uses contains additional vulnerabilities. TKIP basically takes RC4, which was designed to encrypt a single stream of data, and creates a protocol around it for sending arbitrary packets, which may not be reliably delivered. WPA2 provides a more secure way to similarly wrap the AES cipher, but retains support for TKIP/RC4 for legacy devices.
AES and TKIP are not apples to apples. AES is an encryption algorithm. TKIP basically handles the keys that the encryption algorithm uses.
A better apples to apples comparison would be between the encryption algorithms (RC4 and AES) or the key managers (TKIP and CCMP).
Generally, WPA uses TKIP/RC4 and WPA2 (802.11i) uses CCMP/AES.
WPA (TKIP/RC4) was supposed to be a bridge between WEP and WPA2. WPA used RC4 (just like WEP) but enhanced (TKIP) in order improve security while using existing (WEP/RC4) hardware.
WPA2 has always been considered more secure than WPA on paper though until this there has never been a documented exploit for either of them.
Stupider like a fox! - H.S.
AES is a cypher. TKIP is a protocol, the Temporal Key Integrity Protocol, to be precise. The cypher used by WEP and WPA/TKIP is RC4. TKIP is what keeps changing the RC4 key to avoid the attacks on WEP, for which the attacker needs to collect many packets which have been encrypted with the same key. TKIP was invented to salvage older hardware, which only implemented the RC4 cypher.
It is important to know that WEP's weakness is not simply a vulnerable cypher, but a vulnerability of the crypto system. The announcement states that the attack on WPA/TKIP does not actually crack the key, so this too looks like a vulnerability of the crypto system. That highlights the importance of crypto system design. You can't just take a "secure" cypher and be done with it. The protocol surrounding that cypher is just as important.
Go to the attic, you'll have access to the insides of the walls from above. Drop a chain with a weight down an interior wall (so there's no insulation in the way). Cut a hole in the drywall for your ethernet jack. Guide the weight to the hole, a strong magnet(perhaps from a hard drive) can help here. Then just attach your cat5 to the end of the chain, go back to the attic and pull it up. You can run the cat5 across the entire house in the attic and not worry about people tripping on it or anything. It's kind of shitty work, but it's doable if you're just a little bit handy.
Give me Classic Slashdot or give me death!
At least it's not like the Nintendo DS that only supports WEP.
Some notes on wiring -- either power or ethernet cable.
1. Drill two holes in the header, each about 1/2" in diameter, about 2" apart. You put a flashlight over one so you can see what you're doing when you drop the line down the other.
2. On the bottom end, cut a full-sized hole for a standard rework box. You can get standard wall faceplates for snap-in Cat5 outlets. I generally wire with double-hole faceplates, and put a phone cord in the lower one and Cat5 in the upper. A rework box hole gives you a large enough opening that you can get your hand in there and grab stuff. Pull the wire out and run it into a rework box and put that in the wall. (if you have really big hands you might not be able to do this. Find someone with smaller hands or run a loop of wire into the wall first, then drop the wire from the top, through the loop, and then pull the loop out the hole.)
By using an adjacent hole to admit light, I can usually manage to drop a wire into an existing box if I've punched out the knockout on the top, with a bit of care.
Note that all this advice, and the parent poster advice, all assume you don't have firebreaks inside the wall. Many newer houses have 2x4's across the wall halfway up, to keep the space between the walls acting like a chimney. In that case you're going to be cutting drywall and/or finding a seriously long drillbit. (It's possible to weld a drillbit onto the end of a 3' piece of mild steel rod, but it's pretty unpleasant to use.)
Nostalgia's not what it used to be.