I am trying to implement the Fluhrer, Mantin and Shamir attack, one of the ways to break WEP. I seem to have hit on a problem. I have no idea whether or not it is a programming error, or if I don't understand the practical part of the attack properly.

Can I get some verification that I understand how to use it correctly or incorrectly?

Here is how I understand WEP and the FMS attack:

  1. For some constant root key (say 104 bits), random 24 bit IV is generated per message and prepended to the root key. That new key is used to encrypt some data (packets).

    RC4(IV + root key).encrypt(data)

  2. That data can somewhat be considered a constant, since packet data should have known headers.

  3. Many packets are collected (I generated 6 million (IV, RC4(IV + root key).encrypt(data)) pairs) to make the (253/256)^252 chance of the sbox not changing in certain places be more obvious.

  4. With those packets, you get "votes" from each packet on the most likely correct root key byte. To get the votes, do:

    • For 3 <= i <= 15 (104 bit root key)

      • For each packet

        1. Only use packets with IVs that have the form IV[0] = i, IV[1] = '\xff'
        2. For that packet, combine the IV with whatever root key that has been recovered (so for i = 3, the temp key would be IV + "" = IV)
        3. Run the RC4 Key Scheduling Algorithm with the temp key, to try to find those times that the sbox doesn't move the ith index to an unknown place. Return the sbox and j after the using up the temp key once (the (i-1)th KSA step).
        4. Get the byte that was used to encrypt the plaintext by xoring the plaintext at character i - 3 with the ciphertext at i - 3 (to start at index 0). KB = pt[i - 3] xor ct[i - 3]
        5. Figure out the index of KB in the sbox in the current state (after step i - 1, before step i), sbox^-1[KB]
        6. Get the "vote" of the current encrypted data by doing sbox^-1[KB] - j - sbox[i] (to "undo" the j = j + S[i] + K[i mod K.size()] and swap)
      • After all the packets have been processed, get the highest voted octet, and add that to the recovered root key. Then increment i.

So, at i = 3, you would use IV + root key = "\x03\xff\xXX" (last IV byte can be any value) to find root key[0] = '\RK0'

and at i = 4, you would use IV + root key = "\x04\xff\xXX\RK0"

and continue this until all the bytes are found.

Are these step correct for implementing the FMS attack? Am I using the wrong indexes? Using RC4 differently from WEP (significantly enough to cause problems)? I am currently able to recover only the first byte of the key (maybe). Does something change for each consequent byte that I didn't take into account?

  • $\begingroup$ did you ever figure this out? $\endgroup$ Nov 23, 2021 at 21:35


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.