[MLB-WIRELESS] Re: Strong WEP Key Generator

[paul van den bergen]

On Tue, 6 May 2003 12:52 am, rik wrote:
> but how much data do they have to collect before they can crack a 128bit in
> a few hours? isnt it like 2 weeks worth?

read the article! *sheesh*

5 to 6 million packets... which is a few hours worth for a moderately loaded 
link. (for 128 bit WEP)

not that this is just preventing WEP key discovery for bandwidth theft.  there 
are apparently other weaknesses that make the actual data vulnerable too, so 
it depends exactly what you want to protect.  Mind you I have not found a 
really clear discussion of all the threats to data security from WEP.... most 
just focus on the big hole, not teh other smaller holes...

the article says also...

quote
When completed, 802.11i will use Temporal Key Integrity Protocol (TKIP). TKIP 
addresses the WEP static key problem by dynamically updating the key, based 
on WEP's own RC4 encryption across all devices once for every 10,000 packets 
transmitted. For vendors, the good news is that existing devices can be 
updated with firmware updates. The bad news is that 128-bit RC4 changed every 
10,000 packets is still breakable. Even TKIP supporters admit that, at best, 
it's a stopgap solution to wireless security.
end quote.

I have no idea why wep is still breakable, but there you go...


-- 
Dr Paul van den Bergen
Centre for Advanced Internet Architectures
caia.swin.edu.au
pvandenbergen at swin.edu.au
IM:bulwynkl2002
"And some run up hill and down dale, knapping the chucky stones 
to pieces wi' hammers, like so many road makers run daft. 
They say it is to see how the world was made."
Sir Walter Scott, St. Ronan's Well 1824 

To unsubscribe: send mail to majordomo at wireless.org.au
with "unsubscribe melbwireless" in the body of the message