<story><title>Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords</title><url>https://arstechnica.com/information-technology/2019/04/serious-flaws-leave-wpa3-vulnerable-to-hacks-that-steal-wi-fi-passwords/</url></story><parent_chain><item><author>zamadatix</author><text>Downgrade attacks:&lt;p&gt;WPA3 has a transitional mode which allows legacy WPA2 clients to connect. In this mode legacy WPA2 security issues are still present. Is this really a discovery or a given? How is WPA3 supposed to protect against it without requiring either WPA2 clients to be upgraded to support WPA3 security fixes (in which case you don&amp;#x27;t need WPA2 support anymore anyways) or without dropping support for transitional mode? 802.11w fixes much of this but WPA2 didn&amp;#x27;t mandate support for this which is one of the big reasons WPA3 is so much better.&lt;p&gt;Dragonfly downgrade:&lt;p&gt;&amp;quot;The hack can force the access point to use a different curve, presumably one that’s weaker.&amp;quot; note: not &amp;quot;The hack can force the access point to use a different curve, one that’s weak.&amp;quot;.&lt;p&gt;Side channel leaks:&lt;p&gt;Are failures in implementations not WPA3. If you&amp;#x27;re allowing local timing attacks while generating your keys it doesn&amp;#x27;t really matter what protocol you&amp;#x27;re using you&amp;#x27;ve just failed. A real discovery of things in the wild that need to be fixed but nothing to do with the security of the specification.&lt;p&gt;Denial of service:&lt;p&gt;It&amp;#x27;s far more effective and simple to DoS the air than to DoS the APs CPU anyways. Always has been always will be. Besides, would you rather it be faster and have the AP expose side channel attacks instead?&lt;p&gt;&amp;quot;dragonblood&amp;quot;:&lt;p&gt;Makes me think some researchers were out for their 5 minutes of fame with a cool sounding &amp;quot;vulnerability&amp;quot;. To be a little less critical the researches discovered in-the-wild side channel attacks on popular client implementations of the crypto (but that doesn&amp;#x27;t sound as cool as &amp;quot;serious flaws leave WPA3 vulnerable&amp;quot;.</text></item></parent_chain><comment><author>gipsies</author><text>If we look at the paper then these remarks are all discussed:&lt;p&gt;- Defending against downgrade attack: &amp;quot;A client should remember if a network supports WPA3-SAE. That is, after successfully connecting using SAE [..] the client must never connect to this network using a weaker handshake&amp;quot;. The Google Pixel 3 is thankfully already doing this, but others aren&amp;#x27;t. So perfectly preventable, and something the Wi-Fi Alliance could have included in their WPA3 specification.&lt;p&gt;- Side-channel leaks: &amp;quot;A backwards-compatible countermeasure is to replace the two vulnerable branches with a constant-time select utility, and use constant time Legendre symbol computation as defined in [73]&amp;quot;. The WPA3 standard already contained certain side-channel defenses, but it was still vulnerable. They could&amp;#x27;ve also included these new defenses in the WPA3 standard.&lt;p&gt;- Denial-of-Service attack: &amp;quot;... our attack is more efficient than a straightforward DoS where an attacker simply jams the channel.&amp;quot; We only needed to inject 10 commit frames every second to overload a professional AP..&lt;p&gt;- Modern crypto standards should be written so the chance of implementation bugs is low. For example, the new hash-to-curve algorithms being standardized include side-channel defenses in the specification itself. See their usage of the CMOV instruction that provides a &amp;quot;Common software implementations of constant-time selects&amp;quot; &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;tools.ietf.org&amp;#x2F;html&amp;#x2F;draft-irtf-cfrg-hash-to-curve-03&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;tools.ietf.org&amp;#x2F;html&amp;#x2F;draft-irtf-cfrg-hash-to-curve-03&lt;/a&gt;</text></comment>
<story><title>Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords</title><url>https://arstechnica.com/information-technology/2019/04/serious-flaws-leave-wpa3-vulnerable-to-hacks-that-steal-wi-fi-passwords/</url></story><parent_chain><item><author>zamadatix</author><text>Downgrade attacks:&lt;p&gt;WPA3 has a transitional mode which allows legacy WPA2 clients to connect. In this mode legacy WPA2 security issues are still present. Is this really a discovery or a given? How is WPA3 supposed to protect against it without requiring either WPA2 clients to be upgraded to support WPA3 security fixes (in which case you don&amp;#x27;t need WPA2 support anymore anyways) or without dropping support for transitional mode? 802.11w fixes much of this but WPA2 didn&amp;#x27;t mandate support for this which is one of the big reasons WPA3 is so much better.&lt;p&gt;Dragonfly downgrade:&lt;p&gt;&amp;quot;The hack can force the access point to use a different curve, presumably one that’s weaker.&amp;quot; note: not &amp;quot;The hack can force the access point to use a different curve, one that’s weak.&amp;quot;.&lt;p&gt;Side channel leaks:&lt;p&gt;Are failures in implementations not WPA3. If you&amp;#x27;re allowing local timing attacks while generating your keys it doesn&amp;#x27;t really matter what protocol you&amp;#x27;re using you&amp;#x27;ve just failed. A real discovery of things in the wild that need to be fixed but nothing to do with the security of the specification.&lt;p&gt;Denial of service:&lt;p&gt;It&amp;#x27;s far more effective and simple to DoS the air than to DoS the APs CPU anyways. Always has been always will be. Besides, would you rather it be faster and have the AP expose side channel attacks instead?&lt;p&gt;&amp;quot;dragonblood&amp;quot;:&lt;p&gt;Makes me think some researchers were out for their 5 minutes of fame with a cool sounding &amp;quot;vulnerability&amp;quot;. To be a little less critical the researches discovered in-the-wild side channel attacks on popular client implementations of the crypto (but that doesn&amp;#x27;t sound as cool as &amp;quot;serious flaws leave WPA3 vulnerable&amp;quot;.</text></item></parent_chain><comment><author>entropy_</author><text>The downgrade attack works even if both the AP and the device connecting to it are WPA3 capable, that part is not a given</text></comment>