KRACK

securitynetworking

A 2017 attack on WPA2 Wi-Fi that resets encryption keys to replay traffic.

Key Reinstallation Attack abused the WPA2 four-way handshake by forcing reinstallation of an already-used key, resetting nonces and enabling replay or decryption. It affected essentially every Wi-Fi client and drove firmware patches worldwide.

KRACK attacked the four-way handshake in WPA2, the protocol securing essentially every protected Wi-Fi network. By replaying a handshake message, an attacker could force a client to reinstall an already-used key, resetting the counters that must never repeat and enabling decryption of traffic.

The finding's importance is that WPA2 had been formally analysed and considered sound for over a decade. The proofs were correct; they covered the protocol as specified and not the state machine implementations actually built, and the vulnerability lived in the gap between the two. Some implementations were far worse affected than others because of how they handled an ambiguous case in the standard.

The lesson generalizes past Wi-Fi and is the durable part. A correct specification does not produce correct implementations, ambiguity in a standard becomes divergence in the field, and formal verification of a protocol is not verification of the code that speaks it. It also accelerated WPA3, whose handshake was redesigned specifically to remove this class of problem, and demonstrated how long a universally deployed protocol takes to replace even after a serious break.

Also known as: KRACK, Key Reinstallation Attack, CVE-2017-13077

← All glossary entries