There is an abundance of tools and tutorials on how to break WEP encryption. However, I fail to find a nice resource that gives a clear break-down of why the attacks are possible. For example, I know that one of the attacks relies on fake authentication. I however fail to understand how this works because whenever an entity tries to authenticate, the AP will give it a challenge which it will not be able to answer correctly; meaning the fake authentication will be fruitless. How does the adversary gain from this fruitless authentication?
I also read that a short IV means that after a large number of packets, keys will begin to repeat. This kind of makes sense to me -- but I still dont have an understanding of how one might exploit this fact to retrieve the key. What precisely is the implication of IVs beginning to repeat after a certain number of messages?
Then there is the weakness with the message checksum -- that a modification in the message comes with a predictable change in the checksum. How does one exploit this to break the key? Insights into the mechanisms of these attacks will be so helpful.