I'm trying to understand how Krack works on GCM. I thought that looking at GCM would be easier since it's a full break and the video shows a tool that is able to decrypt everything.

I see that the IV is resent, but how does that carry forward? Each packet is sent with an IV that is used to encrypt/decrypt that packet, correct? Am I wrong in thinking the IV is generated from the Anonce, Snonce, MACs and PMK?

If a key is known to be all zeros, that should make it easy to decrypt once the IV is known, but if the IV isn't sent with packet and is in fact generated, then how are so many packets decrypted?

Krack doesn't disclose the PMK so generating the IV on your own is out. Shouldn't you be limited to the number of packets that were sent between the nonce reuse? As in, if 5 packets were sent before the nonce was reused then you would only have enough information to try to decrypt the five packets sent after the first use of the nonce and the five packets sent after it was reused.


From 2.4 of the paper available at https://www.krackattacks.com (emphasis added):

The GCMP protocol is based on AES-GCM, meaning it uses counter mode for encryption, with the resulting ciphertext being authenticated using the GHASH function [28]. Similar to CCMP, it is an AEAD cipher, and secure as long as no IV is repeated under a particular key. In GCMP, the IV is the concatenation of the sender MAC address and a 48-bit nonce. The nonce is also used as a replay counter by the receiver, incremented by one before sending each frame, and initialized to 0 when installing the TK [1, §]. This normally assures each IV is only used once. As with CCMP, the TK is used directly as the key for both communication directions. If a nonce is ever repeated, it is possible to reconstruct the authentication key used by the GHASH function [43].

[28] is NIST SP800-37D (the standard for GCM)
[1] is IEEE 802.11-2016 (the standard for, well, guess)
[43] is 2006 comments by Joux to NIST

| improve this answer | |
  • $\begingroup$ It already felt to me that the calculation of the IV was off in the question. In case somebody doesn't notice: that is what Dave is pointing out if I'm not mistaken. $\endgroup$ – Maarten Bodewes Jan 2 '18 at 13:05
  • $\begingroup$ As a follow up, in regards to wpa_supplicant_v2.4: at the point that the IV is known, which it seems it is from what you pointed out above, and the encryption key is all zeros isn't the GHASH function easily computed? I see that the Krack paper references Authentication Failures in NIST version of GCM (csrc.nist.gov/csrc/media/projects/block-cipher-techniques/…). Is it just for other implementations where the key isn't zeroed out or am I missing something? Sorry for the probably painfully ignorant questions, I'm just trying to wrap my head around this. $\endgroup$ – james_finch Jan 13 '18 at 16:16
  • $\begingroup$ @james_finch: Yes: when key is known due to the zero-key bug (or otherwise) forgery is trivial (for any IV), but the Joux reference [43] shows that repeating IV allows recovering an unknown (and otherwise good) auth key. 6.1 summarizes the general results for unknown key including reference to [43], while 6.3 describes the even-worse zero-key case. $\endgroup$ – dave_thompson_085 Jan 16 '18 at 3:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.