In WEP, the 128-bit challenge string generated by an access point would allow for approximately 340 undecillion unique strings. Would it be problematic were a string to be reused? I suppose with $2^{128}$ possible strings it would take a very long time for an access point, with an average amount of associations, to every repeat a challenge. I don't understand why the challenge must be randomized. If it is only used to authentic a client with a legitimate WEP key, then why couldn't the same challenge string be reused for every authentication attempt? Even if an eavesdropper stored all of them in order to reuse them to gain access to an access point, wouldn't it be easier to intercept a single challenge and response and just use XOR to gain access without the WEP key.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.