BruCON 0x0B

Recently we discovered weaknesses in the Dragonfly handshake of WPA3. But how serious are these issues in practice? In this presentation we will explain the attacks we discovered, and discuss whether they pose a practical risk or not.

In our research, we analysed the security of WPA3. This certification aims to secure Wi-Fi networks, and provides several advantages over its predecessor WPA2, such as protection against offline dictionary attacks and forward secrecy. Unfortunately, we show that WPA3 is affected by several design flaws. Most prominently, we show that WPA3's Dragonfly handshake is affected by password partitioning attacks. These attacks resemble dictionary attacks and allow an adversary to recover the password by abusing timing or cache-based side-channel leaks. Our side-channel attacks target the protocol's password encoding method. The resulting attacks are efficient and low cost: brute-forcing all 8-character lowercase password requires less than 125$ in Amazon EC2 instances. We also discuss backwards-compatible countermeasures against all attacks.

Although all attacks can be mitigated with software changes, our conclusion is that WPA3 does not meet the standards of a modern security protocol. Especially on devices with lightweight processors, vendors may not implement all the costly side-channel countermeasures. This would allow an adversary to perform dictionary attacks even when WPA3 is used.