1

Upon reading about the KRACK attack against WPA2, I see this:

If the victim uses either the WPA-TKIP or GCMP encryption protocol, instead of AES-CCMP, the impact is especially catastrophic. Against these encryption protocols, nonce reuse enables an adversary to not only decrypt, but also to forge and inject packets.

Just from looking at the wpa_supplicant man page, I think I can force use of only CCMP by adding this to wpa_supplicant.conf:

network = {
    ssid="[REDACTED]"
    pairwise=CCMP
    group=CCMP
}

However, when I restart the network this log message from /var/log/messages seems to indicate that TKIP is still being used:

Oct 20 17:27:51 localhost wpa_supplicant[1055]: wlp0s18f2u3: WPA: Key negotiation completed with fc:51:a4:4a:43:d3 [PTK=CCMP GTK=TKIP]

A quick ps -eaf | grep wpa shows that wpa_supplicant is using conf file I edited, and the wpa_supplicant log messages shows that it's connecting to the same SSID as in the conf file.

So, am I doing something wrong, or is what I want impossible?

EDIT: I'm using Fedora 26 with NetworkManager.

11

1 Answer 1

0

The CCMP is the mandatory data integrity protocol in WPA2 (encryption mechanism based on strong cryptographic algorithm AES) , Your Access Point should be protected with WPA2(AES)-PSK mode. To verify it run:

wpa_cli
scan
scan_result

You should see [WPA2-PSK-CCMP] under your access point.

The security searcher has posted a script to test your access point for the key reinstallation attack a.k.a krack attack krackattacks-test-ap-ft.

The patch for wpa_supplicant and hostapd is available and applied through the regular update.

Update to hostapd/wpa_supplicant v2.7 or newer, once available.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .