## 4 Attack Surface Analysis
### Radio Access Control
#### 4.1.1 Pre-Shared Key Based Systems  
PSK authentication is vulnerable to password attacks, including brute-force and dictionary attacks. The subsequent subsections dive into the specifics of these attacks and strategies for scaling them. Online vs. Offline Attack  
This section focuses on attacks targeting wireless network access control, particularly those aimed at authentication mechanisms employing pre-shared keys. Such authentication methods are susceptible to password attacks that can occur offline or online. Online attacks exploit vulnerabilities in the Wi-Fi network while it is actively in use. These attacks often involve intercepting data packets or trying to guess the Wi-Fi password through various combinations. The effectiveness of online attacks is constrained by network traffic and the access point's capacity to handle authentication requests. In contrast, offline attacks target password hashes stored on the network or handshake captures obtained from Wi-Fi connections. Unlike online attacks, offline attacks are not bound by current network activity and are generally faster and more efficient. The success of offline attacks depends on factors such as password complexity and the resources available to the attacker. Online attacks typically take longer than offline attacks due to their reliance on live network interactions and authentication request processing. Consequently, online attacks are more detectable and relatively easier to defend against. Our experiments reveal that online attacks typically require between 1 and 10 s to complete the authentication process, with variations based on the device used and the network's status. Krack  
This attack exploits vulnerabilities in the four-way handshake, a key-exchange process that occurs when a client device attempts to join a protected Wi-Fi network. Here are the cryptographic operations involved in the KRACK:  
1. Four-Way Handshake: The four-way handshake is used to establish a fresh encryption key between the client device and the access point when a device joins a Wi-Fi network. The four messages exchanged during the handshake are as follows: Message 1 (M1): Initiated by the access point. Message 2 (M2): Response from the client. Message 3 (M3): Initiated by the client. Message 4 (M4): Response from the access point. 2. Replay Attack: The attacker captures a previous key exchange and replays it during the attack to force the key reinstallation. 3. Key Reinstallation: The vulnerability in WPA2 identified by the KRACK is related to the improper handling of key reinstallations during the four-way handshake. Instead of rejecting already-used keys, the protocol allows for the reuse of a previously used key. The attacker forces the victim to reinstall an already-in-use encryption key by manipulating the four-way handshake process. The attacker intercepts and modifies the key exchange, tricking the client and access point into reinstalling an encryption key that has already been used. 4. Data Decryption: Once the attacker has successfully forced the key reinstall, they may be able to decrypt and intercept Wi-Fi traffic between the client and the access point. This allows the attacker to potentially gain unauthorized access to sensitive information transmitted over the compromised Wi-Fi connection. The four-way handshake captures the exchange of messages between a client and an access point during the process of establishing a secure connection. The cryptographic values involved in this handshake are as follows:  
Figure 1: Flowchart of steps to scale attacks on radio access interface. the widespread adoption of WPA3 is expected to take several years. Recognizing the limited security knowledge and skills of the general population, it is unlikely that users will immediately recognize the need to upgrade to WPA3 [28]. Furthermore, upgrading all IoT devices to WPA3 presents a considerable challenge, not only for end users but also for cybersecurity professionals and manufacturers, given that not all devices are currently equipped to support WPA3 [42].