Talk:KRACK

Computer Security: Computing Mid‑importance

This article is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer SecurityWikipedia:WikiProject Computer SecurityTemplate:WikiProject Computer SecurityComputer Security articles

Mid

This article has been rated as Mid-importance on the project's importance scale.

This article is supported by WikiProject Computing.

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Answer question about Same-origin_policy
Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Computing: Networking / Software Mid‑importance

This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.ComputingWikipedia:WikiProject ComputingTemplate:WikiProject ComputingComputing articles

Mid

This article has been rated as Mid-importance on the project's importance scale.

This article is supported by Networking task force (assessed as Mid-importance).

This article is supported by WikiProject Software (assessed as Low-importance).

This article is supported by WikiProject Computer Security (assessed as Mid-importance).

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Answer question about Same-origin_policy
Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

Linux Low‑importance

	Linux portal This article is within the scope of WikiProject Linux, a collaborative effort to improve the coverage of Linux on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.LinuxWikipedia:WikiProject LinuxTemplate:WikiProject LinuxLinux articles
Low	This article has been rated as Low-importance on the project's importance scale.

Telecommunications Low‑importance

	Telecommunication portal This article is within the scope of WikiProject Telecommunications, a collaborative effort to improve the coverage of Telecommunications on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.TelecommunicationsWikipedia:WikiProject TelecommunicationsTemplate:WikiProject TelecommunicationsTelecommunications articles
Low	This article has been rated as Low-importance on the project's importance scale.

Workaround by using wired connection[edit]

I feel like this sentence in Workarounds section doesn't belong to this article. It's too trivial. Of course not using wireless network will prevent someone from wireless network attack. It's like suggesting not to take public transport in article about pickpocketing in public transport. "Alternatively, users with unpatched devices can disable their wireless network connection and use a wired alternative – though this may not be practical for many scenarios, such as mobile devices or tablets." --Risinek (talk) 23:35, 5 January 2021 (UTC)[reply]

"keychain" link refers to the wrong article[edit]

In the first paragraph the "keychain" link refers to the physical object used to hold keys. Fly S.Y. (talk) 17:41, 17 October 2017 (UTC)[reply]

Apparently the page describing software keyrings is the same as the page to describe physical key rings. Fly S.Y. (talk) 03:29, 18 October 2017 (UTC)[reply]

Rename 'KRACK' to 'KRACK (Computing)' ?[edit]

Shouldn't this page be renamed to 'KRACK (Computing)' ? --Dadu (talk) 07:00, 17 October 2017 (UTC)[reply]

@Dadu: why? Is there something else that is called "KRACK" and that is just as prominent in WP:RS, that a reader would expect the article to be about instead? Zazpot (talk) 13:22, 17 October 2017 (UTC)[reply]

AES-CCMP, WPA TKIP and GCMP modes - different impact[edit]

Hello. My edit was deleted recently There are different attacks KRACK for AES-CCMP mode and for WPA TKIP / GCMP modes. As I understand (incorrectly) in AES-CCMP there is only keystream reuse (attack can get xor result of several open texts), but attacker can't inject arbitrary packet - it can only replay some older packet. With WPA TKIP and GCMP attacker can inject any packet in addition to keysteam reuse and packet replay attack. ref is https://arstechnica.com/information-technology/2017/10/how-the-krack-attack-destroys-nearly-all-wi-fi-security/ "the attack can do varying levels of damage:" section; better ref is the updated paper https://papers.mathyvanhoef.com/ccs2017.pdf - ccmp and gcmp are AEAD, details are in "6.1 Impact of Nonce Reuse in 802.11" section and "Table 3: Impact of our key reinstallation attack" table: `a5b (talk) 16:15, 17 October 2017 (UTC)[reply]

"TKIP, CCMP, or GCMP. All three protocol use a stream cipher to encrypt frames. Therefore, reuse of a nonce always implies reuse of the keystream. This can be used to decrypt packets. ... all three protocols are also vulnerable to replay attacks." (As i understand, replayed packet will have same replay id, so if attacker have packet with id of 5678, it can be reinjected around the same id affter rekey?)
"When TKIP is used, we can also recover the MIC key as follows. ... this allows us to forge frames in one specific direction"
"When CCMP is used, practical attacks are restricted to replay and decryption of packets. ... and cannot be used to forge arbitrary messages"
"When GCMP is used, the impact is catastrophic. First, it is possible to replay and decrypt packets. Additionally, it is possible to recover the authentication key ... Therefore, unlike with TKIP, an adversary can forge packets in both directions."
Table 3 - "Each cell shows in which direction frames can be replayed, decrypted, or forged"
wpa_supplicant in some versions have incorrect zero key. (desktop linuxes and some versions of android)
The claimed TCP hijack is not part of KRACK attack - it just uses sequence numbers from decrypted packets and to hijack the tcp connection attacker should have connection to the same internet access device. It is is possible over WiFi+WPA with ability of arbitrary packet forging as in GCMP (partially in TKIP). And with CCMP attacker must have another connection to internet to be able to send tcp packets from the same ip address as user have. `a5b (talk) 16:15, 17 October 2017 (UTC)[reply]

Prose or table of "patches" section[edit]

I was supposed to mention this few days ago, but naively thought the list would remain small enough to not be an issue.

I think the section would be better represented as a "reactions" section. Shellshock (software bug)#Patches came immediately into my thoughts, but also Heartbleed#Remediation or Heartbleed#Root causes, possible lessons, and reactions. Heartbleed also has a section on "impact". 84.250.17.211 (talk) 12:30, 9 November 2017 (UTC)[reply]

Pinging @Causa sui: Special:Diff/809736905? See above for proposal. 84.250.17.211 (talk) 18:33, 12 November 2017 (UTC)[reply]

Shellshock affected bash. Heartbleed affected openssl. This affects everything. The information in that section can't be tersely encapsulated in prose. It should be a table. --causa sui (talk) 04:46, 13 November 2017 (UTC)[reply]

And that table isn't big enough http://www.zdnet.com/article/here-is-every-patch-for-krack-wi-fi-attack-available-right-now/ https://www.towifi.ca/list-firmware-driver-updates-krack-wpa2-vulnerability/50.53.87.191 (talk) 05:17, 11 March 2018 (UTC)Caston[reply]