How do attacks on WEP work?

Question

There is an abundance of tools and tutorials on how to break WEP encryption. However, I fail to find a nice resource that gives a clear break-down of why the attacks are possible. For example, I know that one of the attacks relies on fake authentication. I however fail to understand how this works because whenever an entity tries to authenticate, the AP will give it a challenge which it will not be able to answer correctly; meaning the fake authentication will be fruitless. How does the adversary gain from this fruitless authentication?

I also read that a short IV means that after a large number of packets, keys will begin to repeat. This kind of makes sense to me -- but I still dont have an understanding of how one might exploit this fact to retrieve the key. What precisely is the implication of IVs beginning to repeat after a certain number of messages?

Then there is the weakness with the message checksum -- that a modification in the message comes with a predictable change in the checksum. How does one exploit this to break the key? Insights into the mechanisms of these attacks will be so helpful.

Answer 1

Part of the problem you're having is that there are multiple distinct vulnerabilities in WEP, and you're getting confused by the sheer number. For example:

I still don't have an understanding of how one might exploit [repeating IVs] to retrieve the key

Answer: those are two separate vulnerabilities.

The shortness of the IV space is an obvious vulnerability; the keystream used to encrypt the packet is a deterministic function of the IV and the key; if we see two different packets encrypted with the IV, we can immediately reconstruct the xor of the plaintexts (by xor'ing the ciphertexts); depending on the plaintexts, this can often allow us to deduce what the plaintext was.

However, this observation doesn't allow us to recover the key. The key recovery attacks rely instead on the details of how WEP creates the RC4 key (by concatinating the 3 byte IV with the 5 or 13 byte key), and how RC4 processes that key into the initial permutation, and then how it uses that permutation to generate the initial key stream bytes. It turns out that, depending on what the IV is (which the attacker can see), the first byte of the key stream may be correlated to one of the key bytes - by observing enough of these first bytes (which the attacker can deduce, as the first byte of the WEP plaintext is fixed), the attacker can deduce the key.

How does one exploit [the weaknesses with the message checksum] to break the key?

That's a third vulnerability, and it can't directly be used to recover the key (unless a cleverly modified message can confuse the receiver into revealing it somehow).

This weakness is simply the observations that a) the message tag is a publicly computable linear function of the plaintext, and b) by flipping a bit of the ciphertext, we also flip the corresponding bit of the decrypted plaintext. Hence, we can flip an arbitrary bit of the plaintext, and then compute which bits of the tag would be flipped and flip those as well; what this means is that if we know/guess one plaintext message, we can modify it into anything we feel like (possibly restricted to the same length; I'm not sure how we could modify that).

Since this works independent of what the key is, it doesn't help us to recover the key.