3 ms·
Yup! Basically the problem boils down to: "An attacker can derive information about the correctness of parts the PIN from the AP´s responses. > If the attacke
by amckenna 12y ago
Yup! Basically the problem boils down to:
"An attacker can derive information about the correctness of parts the PIN from the AP´s responses.
> If the attacker receives an EAP-NACK message after sending M4, he knows that the 1st half
of the PIN was incorrect.
> If the attacker receives an EAP-NACK message after sending M6, he knows that the 2nd half of the PIN was incorrect.
This form of authentication dramatically decreases the maximum possible authentication attempts
needed from 108 (=100.000.000) to 104 + 104 (=20.000).
As the 8th digit of the PIN is always a checksum of digit one to digit seven, there are at most 104 + 103 (=11.000) attempts needed to find the correct PIN."
Reference - http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf