Re: [OT] Breaking WPA2 by forcing nonce reuse

From	"tv.debian@googlemail.com" <tv.debian@googlemail.com>
Newsgroups	linux.debian.user
Subject	Re: [OT] Breaking WPA2 by forcing nonce reuse
Date	2017-10-20 06:40 +0200
Message-ID	<uCxgd-7Ef-1@gated-at.bofh.it> (permalink)
References	(6 earlier) <uC7Yt-gE-1@gated-at.bofh.it> <uCgS6-5VF-31@gated-at.bofh.it> <uCkCm-8ki-25@gated-at.bofh.it> <uCl5o-8tQ-19@gated-at.bofh.it> <uClI6-vv-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 19/10/2017 21:42, Celejar wrote

[...]
> like the printer. Henrique recently noted that there is a setting
> available on new OpenWRT and LEDE builds that can help, but it's
> apparently not yet included in any release yet:
> 
> https://lists.debian.org/debian-user/2017/10/msg00593.html
> 
> Celejar
> 

I sent that a day ago, but for some reason it didn't make it to the list:

> Hi,
> 
> 17.01.4 just released [2] with fixed wpa and possibility to activate an AP side workaround. It is just a mitigation really, but should in practice impair an exploit. It is OFF by default.
> 
> Quote:
> 
> "an optional AP-side
> workaround was introduced in hostapd to complicate these attacks,
> slowing them down. Please note that this does not fully protect you from
> them, especially when running older versions of wpa_supplicant
> vulnerable to CVE-2017-13086, which the workaround does not address. As
> this workaround can cause interoperability issues and reduced robustness
> of key negotiation, this workaround is disabled by default."
> 
> Option in hostapd.sh [1] is:
> 
> wpa_disable_eapol_key_retries
> 
> 
> [1] https://git.lede-project.org/?p=source.git;a=commitdiff;h=d501786ff25684208d22b7c93ce60c194327c771
> 
> [2] https://downloads.lede-project.org/releases/17.01.4/targets/

So it is part of Latest LEDE release, but I am not aware of other distro 
using this workaround. It comes with a few potential problems, so must 
be thoroughly tested before being deployed, and it likely breaks 
standards which is never good.

Thread

[OT] Breaking WPA2 by forcing nonce reuse Curt <curty@free.fr> - 2017-10-16 17:50 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-16 18:00 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse "Alexander V. Makartsev" <avbetev@gmail.com> - 2017-10-16 19:00 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-18 15:40 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-18 19:10 +0200
    Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-16 21:20 +0200
      Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-17 05:20 +0200
        Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-17 17:00 +0200
          Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-17 20:30 +0200
            Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 03:40 +0200
              Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 13:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 17:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-19 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Ron Leach <ronleach@tesco.net> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-20 15:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Dan Purgert <dan@djph.net> - 2017-10-20 19:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-19 18:20 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 06:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse rhkramer@gmail.com - 2017-10-20 17:30 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Brad Rogers <brad@fineby.me.uk> - 2017-10-20 17:40 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse "tv.debian@googlemail.com" <tv.debian@googlemail.com> - 2017-10-20 18:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse <tomas@tuxteam.de> - 2017-10-19 18:10 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-19 20:50 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse Celejar <celejar@gmail.com> - 2017-10-20 03:00 +0200
                Re: [OT] Breaking WPA2 by forcing nonce reuse David Wright <deblis@lionunicorn.co.uk> - 2017-10-21 21:30 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Brian <ad44@cityscape.co.uk> - 2017-10-16 22:00 +0200
  Re: [OT] Breaking WPA2 by forcing nonce reuse Larry Dighera <LDighera@att.net> - 2017-10-17 17:30 +0200

csiph-web