# If I can crack the AES, how do I crack the wifi [closed]

I am a student major in math. My teacher said that AES (Advanced Encryption Standard) has many applications. For example, the WPA2 in wifi. Then he taught the theory of the AES and never says how to apply it.

So, my question is, if I can crack the AES, how do I crack the wifi and steal others' data (just for learning purpose).

Please give me the concrete steps. If it is too complicate to explain at here, you can give me the reference which I should read.

Edit: the point of my question is not "how to crack AES". My question is "how to crack wifi if I can crack AES". I can choose the key by myself in a private newwork. Then I don't need to crack the AES. The thing I want to do is crack and learn how to crack the wifi.

• You do not crack the AES, if the AES is implemented correctly. This is why the AES is good, and has many applications. – Xander Jun 7 '16 at 19:29
• What do you mean by "crack" if you have the key? Simply decrypt? Some kind of man-in-the-middle attack? – otus Jun 8 '16 at 4:18
• That would entirely depend on the vulnerability you found in AES. However, assuming you mean that you have a method of decrypting the cryptotext without the key, then the problem simply becomes a case of getting the cryptotext. That is a logistically hard problem (since very few radios/drivers are designed for consumers to do this), but not technically hard (since every single Wifi card does this, it just doesn't expose the cryptotext to you). – Aron Jun 8 '16 at 8:49
• Please give me the concrete steps. … The thing I want to do is crack and learn how to crack the wifi. – So, you are practically asking for a tutorial on how to crack WIFI connections? Somewhat like a “step-by-step hacking guide”? If, you should know that that’s off-topic. If that’s not what you’re asking, it would be nice if you could rephrase the question accordingly… – e-sushi Jun 9 '16 at 21:49
• He's onto something though: the key space for AES seems bigger than the password that has been set. – user9070 Jun 10 '16 at 8:44

If you "crack the AES", a very hypothetical assumption, then you could simply parse the WiFi packets and decrypt the messages that are being send.

Cracking AES is however considered impossible. AES-256 is even considered secure against attacks that involve (somewhat less hypothetical but still unavailable) quantum computers.

Note that even RC4, which was one of the reasons that WEP was cracked, is considered pretty secure when used correctly. Generally you are better off attacking the protocol or protocol implementations.

If you really want to attack AES itself then side channel attacks are probably your best option.

Unlike others I don't think that cracking AES is that unlikely - but then I have a rather strict definition of the semantic security of encryption algorithms... The following scenario seems most likely to me (and resembles for example how WEP was cracked).

Note first, that a single cyphertext will produce several valid WPA2 packets when decrypted with different keys. So looking at the stream of cyphertext and directly deducing the information that was sent block by block is impossible.

What is (at the moment only theoretically) possible though, is that with some knowledge of the information that was sent (header information of the WPA protocol for example or the knowledge that a user just opened facebook) you can restrict the possible passwords by looking at the corresponding cyphertexts. (anything that is better than trying every possible password to see whether it results is a packet that might be a part of the facebook page is considered a crack)

You wait until you have enough restrictions, so that you can simply brute-force your way through all remaining possible passwords. The correct password will be the one such that all observed packets "make sense". (having observed enough packets should make a password obtained in this way unique)

From that point onwards you have the password that was used for encryption and you can simply decrypt the cyphertext as it comes along.

Just to emphasize: That there is no "crack" for AES means, that even with the full plaintext information that was sent and the resulting cyphertext you cannot deduce any information about the key that was used. If you can infact deduce anything about the key in such a known-plaintext-attack scenario, you have cracked AES and can apply a scheme as I described above to crack WPA2.

• FYI: a) brute-forcing the password does not have anything to do with breaking AES and b) when trying to brute-force WPA2 passwords, it is common to use known plaintext-ciphertext pairs instead of probable plaintext-ciphertext pairs. Where this won't work: a) If the password is too strong to be brute-forced and b) where there is no password used, but public key authentication. – SEJPM Jun 8 '16 at 12:47
• @SEJPM I am not suggesting to brute-force the password from the start, but If the (theoretical) weakness that you have found in the AES allowed you to reconstruct 200 of the 256 key bits you might get away with brute forcing the remaining 56 bits. – example Jun 8 '16 at 12:49