Denial of Service Attacks Against the 4-Way Wi-Fi Handshake
Mathy Vanhoef, Frank Piessens · 2017
The 4-way Wi-Fi handshake is used to negotiate fresh pairwise keys, and authenticates both the client and Access Point (AP).We analyze this handshake, and discover several new denial-ofservice (DoS) attacks against it.Interestingly, our attacks work even if Management Frame Protection (MFP) is enabled.The first attack abuses the observation that messages in the 4-way handshake undergo linklayer encryption once the pairwise key is installed.More precisely, when message 4 of the handshake is dropped, the handshake times out.The second attack is similar to the second one, but induces the AP into sending the first message 4 with link-layer encryption.Again, this causes the handshake to time out.In the third attack, an adversary waits until the victim completes the 4-way handshake.Then she initiates a rekey by injecting a malformed 4-way handshake messages, causing several implementations to disconnect the client from the network.Finally, we propose countermeasures against our discovered attacks.