3
$\begingroup$

Could you explain the 'Breaking 104 bit WEP in less than 60 seconds' paper, without skipping too much technical details.

Could you an answer questions, like: how is '1.24/256' a significant difference compared to '1/256'? And how this seemingly small difference could lead a '104-bit WEP key' to a reduced required computational effort that is approximately 2^20 RC4 key setups.

'The algorithm is based on the following ideas. Andreas Klein, a German researcher, showed that there is a correlation in RC4 between Keybytes 1 to i-1, the keystream and the keybyte i. If the keybytes 1 to i-1 and the keystream are known, it is possible to guess the next unknown keybyte with a probability of about 1.36/256 which is a little bit higher than 1/256. We were able to show that it is also possible to guess the sum of keybytes i to i+k with a probability of more thatn 1.24/256.'

Improve this question
$\endgroup$
5
  • $\begingroup$ For the general public? Are you serious? I doubt you could answer this in less than 60 days without sending a typical person running for the hills. $\endgroup$
    – Abhi Beckert
    Commented Jul 23, 2013 at 3:50
  • $\begingroup$ @AbhiBeckert Well, how would you explain the significance of 1.24/256 vs 1/256 when skipping the general public part? $\endgroup$
    – user129789
    Commented Jul 24, 2013 at 3:51
  • $\begingroup$ I would explain it in terms of how many years it would take an FPGA to brute force the key. Not an exact science since every FPGA is different, but it should get the point across. $\endgroup$
    – Abhi Beckert
    Commented Jul 24, 2013 at 3:53
  • $\begingroup$ 'many years' <-- they cracked it in less than 60 seconds... How would it even make sense to talk about 'how many years'.... $\endgroup$
    – user129789
    Commented Jul 24, 2013 at 4:11
  • $\begingroup$ Because "many years" is not a number, so they can't get their head around it. $\endgroup$
    – Abhi Beckert
    Commented Jul 24, 2013 at 4:23

1 Answer 1

Reset to default
2
$\begingroup$

According to the paper, it takes up to 53 seconds for enough data to be transferred for the attack to be attempted. Then it takes 1-3 seconds with 50% probability on a 1.7 GHz Pentium-M to perform the crack (presumably this actually means between 1 and 6 seconds for 100% probability?).

I would do a back of the napkin calculation how long the same attack would take against a "proper" wifi network using the same hardware (or even better, on a laptop with a decent GPU for 3D games), and then say something like this:

"It takes less than 60 seconds to crack WEP and X years to crack WPA with a 12 digit password."

I would not say anything like "104 bit" or go into properly long alpha-numeric passwords because you'll just confuse people with stuff like that. It's bad enough you even need to tell them that "WEP" and "WPA" are different, you already lost some people by mentioning two acronyms they've never heard of.

I would sum it up by also saying:

"WEP was designed by idiots. WPA was designed by experts."

Which is a bit harsh on the WEP guys but is basically true. They probably had no idea how insecure their protocol was until long after everyone started using it (to be fair, security wasn't really their goal either).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.