Comment by zamadatix | Hacker News Reader

Comment by zamadatix | Hacker News Reader

Downgrade attacks:

WPA3 has a transitional mode which allows legacy WPA2 clients to connect. In this mode legacy WPA2 security issues are still present. Is this really a discovery or a given? How is WPA3 supposed to protect against it without requiring either WPA2 clients to be upgraded to support WPA3 security fixes (in which case you don't need WPA2 support anymore anyways) or without dropping support for transitional mode? 802.11w fixes much of this but WPA2 didn't mandate support for this which is one of the big reasons WPA3 is so much better.

Dragonfly downgrade:

"The hack can force the access point to use a different curve, presumably one that’s weaker." note: not "The hack can force the access point to use a different curve, one that’s weak.".

Side channel leaks:

Are failures in implementations not WPA3. If you're allowing local timing attacks while generating your keys it doesn't really matter what protocol you're using you've just failed. A real discovery of things in the wild that need to be fixed but nothing to do with the security of the specification.

Denial of service:

It's far more effective and simple to DoS the air than to DoS the APs CPU anyways. Always has been always will be. Besides, would you rather it be faster and have the AP expose side channel attacks instead?

"dragonblood":

Makes me think some researchers were out for their 5 minutes of fame with a cool sounding "vulnerability". To be a little less critical the researches discovered in-the-wild side channel attacks on popular client implementations of the crypto (but that doesn't sound as cool as "serious flaws leave WPA3 vulnerable".

If we look at the paper then these remarks are all discussed:

- Defending against downgrade attack: "A client should remember if a network supports WPA3-SAE. That is, after successfully connecting using SAE [..] the client must never connect to this network using a weaker handshake". The Google Pixel 3 is thankfully already doing this, but others aren't. So perfectly preventable, and something the Wi-Fi Alliance could have included in their WPA3 specification.

- Side-channel leaks: "A backwards-compatible countermeasure is to replace the two vulnerable branches with a constant-time select utility, and use constant time Legendre symbol computation as defined in [73]". The WPA3 standard already contained certain side-channel defenses, but it was still vulnerable. They could've also included these new defenses in the WPA3 standard.

- Denial-of-Service attack: "... our attack is more efficient than a straightforward DoS where an attacker simply jams the channel." We only needed to inject 10 commit frames every second to overload a professional AP..

- Modern crypto standards should be written so the chance of implementation bugs is low. For example, the new hash-to-curve algorithms being standardized include side-channel defenses in the specification itself. See their usage of the CMOV instruction that provides a "Common software implementations of constant-time selects" https://tools.ietf.org/html/draft-irtf-cfrg-hash-to-curve-03

"A client should remember" just transfers things to first trust attacks, if you want to do it right you'd have to make sure you add the network to the device as WPA3 only from the get go.

Side channel attacks, sure, the standard could also have just said "don't be vulnerable to side channel attacks when generating secure data" along with everything else you should do to make a secure system.

Does it really matter how efficient the DoS attack is if any consumer gear can do the in efficient future proof version anyways? As far as intelligent attacks go isn't this yet again an implementation detail where the AP should rate limit responses to a particular client based on it's resources?

Sure, Greenfield things should be written the best they reasonably can be but not being the best something could be doesn't equate to insecure. It's a valid complaint about the standard but not an insecurity.

Again the paper had valid interesting findings in real world side channel attacks and some valid complaints that Dragonfly could have been implemented in better way but it's not focused on attacking those instead it's focused on making big noise about how bad running things in WPA2 mode is bad under the title of being about WPA3.

I again feel that most of these points are all discussed in the paper. Trust-on-first-usage is also used in SSH. Attack uses spoof MAC addresses, hard to rate-limit that. Modern crypto should be designed to reduce chance of implementation flaws. Paper concludes that WPA3 is still better than WPA2. Most attacks are on WPA3's Dragonfly. Etc. The most practical attacks are downgrades to WPA2 though, so the press might focus too much on that..

Hmm, so I can't have several APs sharing the same ESSID with the newer ones supporting WPA3 and the older ones WPA2?

The downgrade attack works even if both the AP and the device connecting to it are WPA3 capable, that part is not a given

"WPA3 capable" means nothing one way or the other about WPA3 if you are running it in WPA2 mode though. That's my point.

> Dragonfly downgrade:

When WPA3 was announced, some people here were very skeptical of the Dragonfly protocol:

* https://news.ycombinator.com/item?id=17402274

Preface: I am not at all an expert on WiFi

In WPA2 you can send deauthentication "frames" to clients to get them to disconnect from the access point. Later I was told these "control frames" can now be encrypted, with an extension/modification to WPA2 supported in the better consumer wireless routers like Linksys?

In response to your Denial of Service point: Does WPA3 make it harder to disconnect clients? (or are you talking about simply overwhelming the airspace with traffic/interference/jamming?)

AFAIK WPA3 makes PMF (Protected Management Frames) mandatory.

As dcbadacd described this protection capability (.11w) is mandatory to be WPA3 certified and when operating in WPA3 mode. Transitional mode (WPA2 compatible mode) doesn't mandate it's use because not all WPA2 clients are compatible with it.

The denial of service I'm talking about is as simple as setting up a virtual AP out of your laptop wifi adapter and constantly sending broadcast frames out at max rate. Similar to screaming loudly to interrupt a secret conversation rather than actually attacking the encoded language.

There is only so much effort one can put into denial of service attacks in wireless. The fact that this involves radio frequencies means there is always a nuclear option: massive broadcasts of white noise. There is no way for wifi devices to adapt to such an attack. So the fact that some denial attacks can happen using exploits is moot. If the attacker really wants to hold your network down he isn't going to bother with tricky packets. He is going to jam the entire spectrum. Whether you are running WEP or some bleeding edge WPA5.7 implementation won't matter if all anyone can hear is white noise.

Yeah but if you're a sleazy hotel chain that simply wants people to use their crappy expensive wifi instead of personal hotspots then you can't use the "nuclear option" as the white noise will also fuck up your network.

This is the type of attack that is being defended against here, not white-noise bombs.

At least with wpa2 there are devices that perform DOS by just telling devices to disassociate themselves from networks. These are (illegally) used by hotels to force you to use their paid Wi-Fi. Easier than filling all the channels or overloading an AP CPU.

Reply on news.ycombinator.com