Dragonblood: Attacking the Dragonfly
Handshake of WPA3
Mathy Vanhoef and Eyal Ronen

Black Hat USA. Las Vegas, 7 August 2019.

Background: Dragonfly in WPA3 and EAP-pwd= Password Authenticated Key Exchange (PAKE)
Provide mutual
authentication

Negotiatesession key

Forward secrecy& prevent offline
dictionary attacks

Protect against
server compromise
2Dragonfly
Convert password togroup element P

Convert password togroup element P

Commit phase

Negotiate shared key
Confirm phase

Confirm peer negotiated same key
3

Dragonfly
Convert password togroup element P

Convert password togroup element P

SupportsCommit
two crypto
phase groups:
1. MODP groups
2. Elliptic curves
Confirm phase4What are MODP groups?
Operations performed on integers x where:› x < 𝑝 with 𝑝 a prime› 𝑥 𝑞 mod 𝑝 = 1 must hold› 𝑞 = #elements in the group All operations are MODulo the Prime (= MODP)
5

Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞
return P Convert value to a MODP element

6

Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞
return P

Problem for groups 22-24:
high chance that value >= p
7

Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: ???

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞
return P

8

Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞
return P

9Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue#iterations depends on password

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞
return P

10

Convert password to MODP elementfor (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue#iterations depends on password

P = 𝑣𝑎𝑙𝑢𝑒 (𝑝−1)/𝑞return P

No timing leak countermeasures,
despite warnings by IETF & CFRG!
11

IETF mailing list in 2010“[..] susceptible to side channel (timing) attacks
and may leak the shared password.”“not so sure how important that is [..] doesn't leakthe shared password [..] not a trivial attack.”

12

Leaked information: #iterations needed
Client address

addrA

Measured13

Leaked information: #iterations needed
Client address

addrA

Measured

Password 1

Password 2

Password 3
14

Leaked information: #iterations needed
Client address

addrA

Measured

Password 1Password 2

Password 3
15

What information is leaked?
for (counter = 1; counter < 256; counter++)value = hash(pw, counter, addr1, addr2)
if value >= p: continue

Spoof client address to obtain(𝑝−1)/𝑞
P = 𝑣𝑎𝑙𝑢𝑒
different execution & leak new data

16

Leaked information: #iterations needed
Client address

addrA

addrB

Measured

Password 1

Password 2

Password 3
17

Leaked information: #iterations needed
Client address

addrA

addrB

Measured

Password 1

Password 2

Password 3
18

Leaked information: #iterations needed
Client address

addrA

addrBaddrC

Measured

Password 1

Password 2

Password 3
19

Leaked information: #iterations needed
Client address

addrA

addrB

addrC

Measured

Password 1

Password 2

Password 3
20

Leaked information: #iterations needed
Client address

addrA

addrB

addrC

MeasuredForms a signature of the password

Password 1

Password 2

Need ~17 addresses to determine
Password 3password in RockYou dump
21

Raspberry Pi 1 B+: differences are measurable

22

Raspberry Pi 1 B+: differences are measurable

Hostap AP: ~75 measurements / address23

What about elliptic curves?
Operations performed on points (x, y) where:› x < 𝑝 and y < 𝑝 with 𝑝 a prime› 𝑦 2 = 𝑥 3 + 𝑎𝑥 + 𝑏 mod 𝑝 must hold

 Need to convert password to point (x,y) on the curve24Hash-to-curve: EAP-pwd
for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
return (x,𝑥 3 + 𝑎𝑥 + 𝑏)

EAP-pwd: similar timing
leak with elliptic curves
25

Hash-to-curve: WPA3 (simplified)for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

return P

WPA3: always do 40
loops & return first P
26

Hash-to-curve: WPA3 (simplified)for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

return P

Problem for Bainpool curves:
high chance that x >= p27

Hash-to-curve: WPA3 (simplified)for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,return P

𝑥 3 + 𝑎𝑥 + 𝑏)

Code may be skipped!

28

Hash-to-curve: WPA3 (simplified)for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

returnP#Timesskipped depends on password

29

Hash-to-curve: WPA3 (simplified)for (counter = 1; counter < 40; counter++)x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

returnP simplified,execution time for several client MAC
addresses forms a signature of the password.
30

CacheAttacks
31

NIST Elliptic Curves

Monitor using Flush+Reload tofor (counter = 1; countercounter++)know <in40;
which
iteration we are
x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

return P

NIST curves: use Flush+Reload todetect when code is executed
32

Bainpool Elliptic Curves

Monitor using Flush+Reload tofor (counter = 1; countercounter++)know <in40;
which
iteration we are
x = hash(pw, counter, addr1, addr2)
if x >= p: continue

if square_root_exists(x) and not P:
P = (x,𝑥 3 + 𝑎𝑥 + 𝑏)

return P

Brainpool curves: use Flush+Reload
to detect when code is executed33

Cache-attacks in practice
Requires powerfull adversary:› Run unpriviliged code on victim’s machine› Act as malicious client/AP within range of victim
Abuse leaked info to recover the password› Spoof various client addresses similar to timing attack› Use resulting password signature in dictionary attack
34

Attack Optimizations
Timing & cache attack result in password signature› Both use the same brute-force algorithm

Improve performance using GPU code:› We can brute-force 𝟏𝟎𝟏𝟎 passwords for $1› MODP / Brainpool: all 8 symbols costs $67› NIST curves: all 8 symbols costs $14k35

Implementation
Inspection
36

Invalid Curve Attack

Point isn’t on curve

Commit(x’, y’)
Negotiated key
is predictable

37

Invalid Curve Attack

Point isn’t on curve

Commit(x’, y’)
Negotiated key
is predictable
Commit reply
Guess key andsend confirm
Confirm phase38

Invalid Curve Attack

Point isn’t on curve

Commit(x’, y’)
Negotiated key
is predictable
Bypasses authentication
Commit reply

 EAP-pwd: all implementations affected
Guess key and WPA3:
only iwd is vulnerable
send confirmConfirm phase39

Implementation Vulnerabilities II
Bad randomness:› Can recover password element P› Aruba’s EAP-pwd client for Windows is affected› With WPA2 bad randomness has lower impact!
Side-channels:› FreeRADIUS aborts if >10 iterations are needed› Aruba’s EAP-pwd aborts if >30 are needed› Can use leaked info to recover password
40

Wi-Fi SpecificAttacks
41

Denial-of-Service Attack
Convert password togroup element P

Convert password togroup element P

AP converts password to EC
point when client connects› Conversion is computationally expensive (40 iterations)› Forging 8 connections/sec saturates AP’s CPU
42

Downgrade Against WPA3-Transition
Transition mode: WPA2/3 use the same password› WPA2’s handshake detects downgrades  forward secrecy› Performing partial WPA2 handshake  dictionary attacks
Solution is to remember which networks support WPA3
› Similar to trust on first use of SSH & HSTS
› Implemented by Pixel 3 and Linux’s NetworkManager

43Crypto Group DowngradeHandshake can be performed with multiple curves› Initiator proposes curve & responder accepts/rejects› Spoof reject messages to downgrade used curve= design flaw, all client & AP
implementations vulnerable
44

Disclosure
45

Disclosure process
Notified parties early with hope to influence WPA3
› Some initially sceptic, considered it implementation flaws› Group downgrade: “was known, but forgot to warn about it”
Reaction of the Wi-Fi Alliance› Privately created backwards-compatible security guidelines› 2nd disclosure round to address Brainpool side-channels

46

Fundamental issue still unsolved› On lightweight devices, doing 40 iterations is too costly› Even powerfull devices are at risk: handshake might beoffloaded the lightweight Wi-Fi chip itself!

Wi-Fi standard now being updated› Prevent crypto group downgrade attack› Allow offline computation of password element47Additional upates to Wi-Fi standard
MODP crypto groups:› Restrict usage of weak MODP groups› Constant-time algo (modulo intead of iterations)Elliptic curve groups:› Restrict usage of weak elliptic curves› Constant-time algo (simplified SWU)
48

Updates aren’t backwards-compatible
Might lead to WPA3.1?
› Not yet clear how this will be handled› Risk of downgrade attacks to original WPA3
Will people be able to easily attack WPA3?
› No, WPA3 > WPA2 even with its flaws› Timing leaks: non-trival to determine if vulnerable

49

Conclusion› WPA3 vulnerable to side-channels› Countermeasures are costly› Standard now being updated› WPA3 > WPA2 & planned updates are strong
https://wpa3.mathyvanhoef.com
50