Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

[Christian Huitema <[e-mail]>]

On Friday, August 28, 2015 2:25 AM, Stefan Winter wrote:
> To: [e-mail]
> Subject: Re: [saag] Would love some feedback on Opportunistic Wireless
> Encryption
> 
> Hi,
> 
> > You are right that there will be some initial legacy issues -- but if
> > we can convince Windows 10 Mobile, Apple iOS, and Android willing to
> > include support (which seems likely, "support" is trivial - basically
> > 1: try the SSID as the passphrase and 2: don't bother showing a lock
> > icon)
> 
> Or, for wireless sniffing kit of your choice:
> 
> 1) try to decrypt with the SSID as the password
> 2) win!

It is a bit more complicated than that, but not much. With WPA2, the traffic is not directly encrypted with the password, but instead with a key derived from the password, the SSID, an Access Point nonce, and a Station nonce. Even if the password is shared, each client uses a different set of nonce, and thus a different key. However, the nonce are transmitted in clear-text during the initial exchange. That means the attack goes as:

1) Capture the initial exchange between Station and Access point, and remember the nonce.
2) Assume that the SSID is the password and try to derive the per station key using the nonce.
3) Win!

This is in fact the main limitation to Warren's approach. The proposed OWE system will still be vulnerable to passive listener attacks, and is thus not much of an improvement over open networks. 

Note that this is also a limitation of the "public password" approach, as in "ask the password to the bartender." We can hypothesize that mass surveillance systems will quickly build a database linking networks, SSID and public passwords. After all, the initial WPA2 exchange carries authentication codes that are the hash of the nonce and the password, which trivially enables dictionary attacks. That means the procedure will be:

1) Capture the initial exchange between Station and Access point, and remember the nonce.
2) Retrieve the password associated to the SSID from the database.
3) Derive the per station key using the nonce.
4) Win!

Thinks would be different if instead of just sending the nonce in clear text the WPA2 exchange used some variation of Diffie-Hellman or EKE. Attackers would need to move from "passive listening" to "actively implement MITM attack," and we believe that might curtail mass surveillance efforts. But that's not the case.

-- Christian Huitema