Model based fuzzing of the WPA3 Dragonfly handshake

In this master thesis, a model based fuzzing framework targeting the new Simultaneous Authentication of Equals handshake (or Dragonfly) will be developed. This handshake is the central part of the WPA3 certification program, that was published in early 2018 by the non-profit organization named Wi-Fi Alliance [All19a]. This new handshake remedies two security limitations of the existing WPA/WPA2 4-way handshake: Offline dictionary attacks following an active deauthentication attack are ineffective, because Dragonfly allows only a single guess at the password by interacting with the involved handshake participants. Furthermore, since Dragonfly establishes each session a unique ephemeral Pairwise Master Key (PMK), perfect forward secrecy will be guaranteed. In addition, protected management frames will be mandatory for new devices in order to obtain WPA3 certified status by the Wi-Fi Alliance. This makes offline dictionary attacks in general infeasible. The Dragonfly exchange does not obsolete the 4-way handshake, it merely replaces the WPA2 open system authentication in the authentication request phase with four additional frames called the SAE-Commit and SAE-Confirm message. If the confirmation token is valid, the association phase and 4-way handshake continues with the derived high entropy PMK. A primary goal of the thesis will be a model of the finite state machine of the SAE handshake and a set of fuzzing heuristics. These are used to generate test cases designed to uncover logical vulnerabilities within SAE handshake states. Those heuristics (or rules) will tamper with the sequence of frames, the content of the frames and format of frames. Another goal of the thesis will be a software implementation of the model based test suite that will target soon to be expected WPA3 hardware. Despite introducing additional security capabilities, a new version of a handshake often introduces complexity and grounds for fresh security vulnerabilities. Additionally, new hardware must coexist with old hardware during a transition period (which is often long, as history has shown in the 802.11 industry). Those facts motivate a modern model based fuzzing approach on emerging WPA3 devices and software. Recent research has shown in the FREAK TLS/SSL downgrade vulnerability [Beu+15] that a combination of state machine composition bugs and weak cipher suites such as RSA_EXPORT lead to a new class of vulnerabilities. Similar methodological approaches were successful in 802.11 networks, when Vonhoef et al. demonstrated key re-installation attacks on the WPA2 4-way handshake [VP17]. Because WPA3-SAE predates the discovery of the key re-installation attacks and relies on the same EAPOL 4-way handshake, it cannot be excluded that future WPA3 devices are subject to the same attack model [wla19]. SAE authentication is fully implemented in hostapd and wpa_supplicant since version 2.7. While these implementations will be primarily tested for deviant traces and logical state flaws, a secondary focus will be cast on unsafe programming practices which may lead to memory corruption issues such as stack overflows, heap overflows, integer overflows, format string vulnerabilities, NULL pointer dereferences and so on.