The WEP secure channel works by sending $$IV||(m||CRC(m) \oplus RC_4(K,IV)$$ where IV is an asynchronous initial vector, K is an encryption key and CRC is a cyclic redundancy check function.

I know there are lots of attacks on this scheme. I also know that this scheme does not protect confidentiality, integrity or sequentiality. However what is meant when we say that in certain way it protects authenticity? The text I'm reading says:

Message authenticity in WEP is not specically protected by a message authentication code. It is protected in the sense that an adversary cannot push a message which makes sense with an unused IV without knowing K. It is enough to know one plaintext and ciphertext to reuse the IV.

Why is authenticity protected in some sense but not integrity? To be honest the last two sentences of the last quotation make no sense to me.


It makes no sense since its nonsense. Let me explain why. Consider an attacker who captures a message of the form $(IV,c)$ for a plaintext $m$ that is not known to the attacker. The aim of the attacker is to "push" the message $m\oplus\Delta$ (e.g., the attacker wishes to flip some bits of $m$. Then, since CRC is linear, the attacker can compute $c'=c \oplus(\Delta,CRC(\Delta))$ and "push" the message $IV,c'$ which will decrypt to $m\oplus\Delta$.

Technically, one could argue that the text is just arguing that you can't push a message with an unknown IV and here I am reusing the IV. However, who cares if the attacker reuses or not; the recipient will accept reused IVs so the attack works.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.