4 ms·

For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?

by MadSax 9y ago

throwasehasdwi 9y ago
It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me". This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same thing as trying to guess a password from some leaked hashes vs trying to guess a password using the gmail interface.
- MadSax 9y ago
  Thanks. I also hope that deauth frames are encrypted in the next version of WPA.
  - throwasehasdwi 9y ago
    They are a current feature but not the baseline which means in practice implementations are buggy or non existent. I've had a few nicer routers where I could turn the options on but most clients are not able to connect :( . I need to be in the baseline standard to get qualified or nobody will implement it.
- xori 9y ago
  I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline. EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in for that encrypted message and use that as your "test that you got it right" I think that at the end of the day, no matter what key stretching techniques you use. A bad starting key results in a bad end key.
  - stickfigure 9y ago
    Blocking isn't really necessary. How many attempts could an AP process per second? Not enough to try a large dictionary with variations.
    - phinnaeus 9y ago
      Wouldn't that effectively be jamming the AP at that point?
      - JetSpiegel 9y ago
        At what point you call security, or just look around the room and check who is jamming the WiFi.
  - throwasehasdwi 9y ago
    You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the AP by sending auth requests faster than it allows but that doesn't hurt the channel any more than barrage jamming which is un-blockable.
    - xori 9y ago
      But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.
      - throwasehasdwi 9y ago
        I'm not a crypto expert and I'm sure even if I was it would be difficult to explain. Wiki page on SRP has a good description though: Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. In layman's terms, given two parties who both know a password, SRP (or any other PAKE protocol) is a way for one party (the "client" or "user") to demonstrate to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. Further, it is not possible to conduct an offline brute force search for the password. https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...
mrb 9y ago
PAKE is awesome, yet not very well-known :-( In a nutshell a PAKE scheme guarantees that (1) a passive attacker has no way to brute force passwords at all, and (2) that an active attacker can at most test one candidate password per authentication attempt. PAKE is used by Thread (IOT protocol built on top of IEEE 802.15.4: https://threadgroup.org/ https://threadgroup.org/ and it's precisely its use of PAKE that makes it one of the most secure wireless protocols IMHO. Disclosure: I helped security-review it during its design.) Various PAKE schemes exist but a simple one based on Diffie-Hellman works like this (called DH-EKE): 1. Client selects random priv, pub key pair: a, g^a 2. Server selects random priv, pub key pair: b, g^b 3. Client sends its pub key encrypted with client's password: E(g^a, passwd) 4. Server sends its pub key encrypted with client's password: E(g^b, passwd) 5. Client and server each decrypts the packets (with the password that they both know) and get each other's pub keys: g^a, g^b 6. Client and server proceed with standard Diffie-Hellman: they compute g^ab use this value as an encryption key 7. Client and server do a message exchange encrypted with g^ab, to verify they both derived the same key. Note: I demonstrate the scheme DH-EKE because it's simple. But please know this scheme is flawed when naively implemented. In theory it should be safe when used with an elliptic curve variant using Elligator https://elligator.cr.yp.to/ https://elligator.cr.yp.to/ but I haven't seen much research and peer reviews of Elligator... Other PAKE schemes are considered perfectly secure (but their complexity makes them unsuitable to be explained in an HN comment, eg: J-PAKE.) What can an "offline" attacker do? He can passively sniff the packets and get E(g^a, passwd) and E(g^b, passwd) but there is no way for him to bruteforce the password. He can try to decrypt the packet with candidate passwords, but he does not know when he guesses the right one, because a successful decryption will reveal g^a or g^b however these value are indistinguishable from random data (when using Elligator because that's exactly what it guarantees: that a pub key is indistinguishable from random data.) And even if he guessed right, he would obtain g^a and g^b, but would not be able to decrypt any further communications as the use of Diffie-Hellman makes it imposible to calculate the encryption key g^ab. What can an "online" attacker do? If he actively MiTM the connection and pretends to be the legitimate server, he can send his own E(g^b, passwd) to the client using one guessed candidate password. If he guessed wrong, then the client will decrypt to an incorrect g^b, will not calculate the right g^ab, and step 7 will fail. Good. At least the client can detect a (failed) password guess attempt. And that's all the attacker can do. Each authentication attempt gives him only 1 chance to test 1 password. If, out of frustration, the client tries to retype the password and re-auth 3 times, then the attacker can at most try to guess 3 candidate passwords. He can't bruteforce many passwords. An effort is ongoing to standardize one of the PAKE schemes, called J-PAKE, in TLS: https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.... TLS with J-PAKE is what Thread uses.

For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?

by MadSax 9y ago

For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?

throwasehasdwi 9y ago

It doesn't give you a hash to crack. It reduces your speed of guessing passwords from "how quick can you hash X", which is millions of times per second, to "how many times can I attempt to get in before the access point blocks me". This major issue with WPA password cracking today is that it can be done "offline". You can pull the handshake out of the air and bang on it as long as you want. It's pretty much the same thing as trying to guess a password from some leaked hashes vs trying to guess a password using the gmail interface.

MadSax 9y ago
Thanks. I also hope that deauth frames are encrypted in the next version of WPA.
- throwasehasdwi 9y ago
  They are a current feature but not the baseline which means in practice implementations are buggy or non existent. I've had a few nicer routers where I could turn the options on but most clients are not able to connect :( . I need to be in the baseline standard to get qualified or nobody will implement it.
xori 9y ago
I'm not sure how PAKE works, but how would an AP block you? MAC address are forgeable. And any nonce an AP sends down as a one-time salt would be visible to you and you could still just brute force it offline. EDIT: After reading up on SPAKE2, it's basically just a Diffe-Hellman exchange. You can still totally do a brute force because you know what the first encrypted payload should look like and you can listen in for that encrypted message and use that as your "test that you got it right" I think that at the end of the day, no matter what key stretching techniques you use. A bad starting key results in a bad end key.
- stickfigure 9y ago
  Blocking isn't really necessary. How many attempts could an AP process per second? Not enough to try a large dictionary with variations.
  - phinnaeus 9y ago
    Wouldn't that effectively be jamming the AP at that point?
    - JetSpiegel 9y ago
      At what point you call security, or just look around the room and check who is jamming the WiFi.
- throwasehasdwi 9y ago
  You can't brute force a nonce offline when you don't know if you answer is right unless you ask the AP. Different protocols than sending hashes where you can tell if your hash is correct just by looking at it. You are right that the AP couldn't block you without blocking everyone, but since you need to check your answer with the AP for each guess your attack becomes extremely visible. I guess you could still DDOS the AP by sending auth requests faster than it allows but that doesn't hurt the channel any more than barrage jamming which is un-blockable.
  - xori 9y ago
    But you can capture the first encrypted packet from the router, and you know what the protocol is to test if your decoded version is correct. I still don't see how this helps.
    - throwasehasdwi 9y ago
      I'm not a crypto expert and I'm sure even if I was it would be difficult to explain. Wiki page on SRP has a good description though: Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. In layman's terms, given two parties who both know a password, SRP (or any other PAKE protocol) is a way for one party (the "client" or "user") to demonstrate to another party (the "server") that they know the password, without sending the password itself, nor any other information from which the password can be broken. Further, it is not possible to conduct an offline brute force search for the password. https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...

mrb 9y ago

PAKE is awesome, yet not very well-known :-( In a nutshell a PAKE scheme guarantees that (1) a passive attacker has no way to brute force passwords at all, and (2) that an active attacker can at most test one candidate password per authentication attempt. PAKE is used by Thread (IOT protocol built on top of IEEE 802.15.4: https://threadgroup.org/ https://threadgroup.org/ and it's precisely its use of PAKE that makes it one of the most secure wireless protocols IMHO. Disclosure: I helped security-review it during its design.) Various PAKE schemes exist but a simple one based on Diffie-Hellman works like this (called DH-EKE): 1. Client selects random priv, pub key pair: a, g^a 2. Server selects random priv, pub key pair: b, g^b 3. Client sends its pub key encrypted with client's password: E(g^a, passwd) 4. Server sends its pub key encrypted with client's password: E(g^b, passwd) 5. Client and server each decrypts the packets (with the password that they both know) and get each other's pub keys: g^a, g^b 6. Client and server proceed with standard Diffie-Hellman: they compute g^ab use this value as an encryption key 7. Client and server do a message exchange encrypted with g^ab, to verify they both derived the same key. Note: I demonstrate the scheme DH-EKE because it's simple. But please know this scheme is flawed when naively implemented. In theory it should be safe when used with an elliptic curve variant using Elligator https://elligator.cr.yp.to/ https://elligator.cr.yp.to/ but I haven't seen much research and peer reviews of Elligator... Other PAKE schemes are considered perfectly secure (but their complexity makes them unsuitable to be explained in an HN comment, eg: J-PAKE.) What can an "offline" attacker do? He can passively sniff the packets and get E(g^a, passwd) and E(g^b, passwd) but there is no way for him to bruteforce the password. He can try to decrypt the packet with candidate passwords, but he does not know when he guesses the right one, because a successful decryption will reveal g^a or g^b however these value are indistinguishable from random data (when using Elligator because that's exactly what it guarantees: that a pub key is indistinguishable from random data.) And even if he guessed right, he would obtain g^a and g^b, but would not be able to decrypt any further communications as the use of Diffie-Hellman makes it imposible to calculate the encryption key g^ab. What can an "online" attacker do? If he actively MiTM the connection and pretends to be the legitimate server, he can send his own E(g^b, passwd) to the client using one guessed candidate password. If he guessed wrong, then the client will decrypt to an incorrect g^b, will not calculate the right g^ab, and step 7 will fail. Good. At least the client can detect a (failed) password guess attempt. And that's all the attacker can do. Each authentication attempt gives him only 1 chance to test 1 password. If, out of frustration, the client tries to retype the password and re-auth 3 times, then the attacker can at most try to guess 3 candidate passwords. He can't bruteforce many passwords. An effort is ongoing to standardize one of the PAKE schemes, called J-PAKE, in TLS: https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.txt https://www.ietf.org/archive/id/draft-cragie-tls-ecjpake-01.... TLS with J-PAKE is what Thread uses.