DOS attack on WPA 802.11?

[William Arbaugh]

There is another reason why it won't change. The majority of the IEEE 
are not interested in denial of service attacks. This issue has been 
brought up several times at TGi and other meetings by myself, Bernard 
Aboba and a few others. The standard response is that this is RF and 
you can always do a DoS.  But, they're missing the point of the cost of 
the attacker to run the attack.

Unfortunately right now, anyone with a NIC card and laptop can deny 
service to multiple AP's on a WLAN using tools available on the 
Internet. This is true for the current and ALL future standards, and 
each case they don't have to resort to sending malformed frames to 
TKIP. It is just a simple, unprotected by a MIC/MAC, disassociate 
message.

On Thursday, Dec 5, 2002, at 12:40 US/Eastern, Arnold G. Reinhold wrote:

> At 10:48 PM -0500 11/29/02, Donald Eastlake 3rd wrote:
>> Arnold,
>>
>> If you want to play with this as in intellectual exercise, be my 
>> guest. 
>> But the probability of changing the underlying IEEE 802.11i draft
>> standard, which would take a 3/4 majority of the voting members of 
>> IEEE
>> 802.11, or of making the WiFi Alliance WPA profiling and subseting of
>> 802.11i incompatible with the standard, are close to zero.
>>
>
> Cryptographic standards should be judged on their merits, not on the 
> bureaucratic difficulties in changing them. Specs have been amended 
> before. Even NSA was willing to revise its original secure hash 
> standard. That's why we have SHA1.  If I am right and WPA needlessly 
> introduces a significant denial of service vulnerability, then it 
> should be fixed. If I am wrong, no change is needed of course.
>
> Check out the President's message for September 202 at the Association 
> of Old Crows web site ("Serving the Electronic Warfare and Information 
> Operations Community"): http://www.aochq.org/news.htm
>
>
> Arnold Reinhold
>
> ---------------------------------------------------------------------
> The Cryptography Mailing List
> Unsubscribe by sending "unsubscribe cryptography" to 
> majordomo at wasabisystems.com
>


---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com