Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2
Open accessAbstract
We introduce the key reinstallation attack. This attack abuses design or implementation flaws in cryptographic protocols to reinstall an already-in-use key. This resets the key's associated parameters such as transmit nonces and receive replay counters. Several types of cryptographic Wi-Fi handshakes are affected by the attack. All protected Wi-Fi networks use the 4-way handshake to generate a fresh session key. So far, this 14-year-old handshake has remained free from attacks, and is even proven secure. However, we show that the 4-way handshake is vulnerable to a key reinstallation attack. Here, the adversary tricks a victim into reinstalling an already-in-use key. This is achieved by manipulating and replaying handshake messages. When reinstalling the key, associated parameters such as the incremental transmit packet number (nonce) and receive packet number (replay counter) are reset to their initial value. Our key reinstallation attack also breaks the PeerKey, group key, and Fast BSS Transition (FT) handshake. The impact depends on the handshake being attacked, and the data-confidentiality protocol in use. Simplified, against AES-CCMP an adversary can replay and decrypt (but not forge) packets. This makes it possible to hijack TCP streams and inject malicious data into them. Against WPA-TKIP and GCMP the impact is catastrophic: packets can be replayed, decrypted, and forged. Because GCMP uses the same authentication key in both communication directions, it is especially affected. Finally, we confirmed our findings in practice, and found that every Wi-Fi device is vulnerable to some variant of our attacks. Notably, our attack is exceptionally devastating against Android 6.0: it forces the client into using a predictable all-zero encryption key.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Vanhoef and Piessens discovered a vulnerability in the four-way handshake that allows an adversary to decrypt a user's traffic without capturing the handshake or knowing the key.
“Vanhoef and Piessens discovered a vulnerability in the four-way handshake that would give any adversary the ability to decrypt a user's traffic without needing to capture the handshake and have knowledge of the key [2].”
From A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3 (2018) · cites this paper as [2]
The Introduction and Conclusion say the four-way handshake is vulnerable to key reinstallation attacks that can enable frame decryption; §6.4 says the attack does not recover the session key. But §3.3 requires an adversary in a man-in-the-middle position to manipulate handshake messages, including a retransmission of message 3. The paper therefore does not support the claim that any adversary can decrypt traffic without capturing handshake messages. (LLM, conf=0.87)
Experimental — accuracy not yet measuredFor KRACK, the attacker sets the counters to their initial values and can then replay messages and decrypt them.
“For this attack, the attacker sets the counters to their initial values and can then replay messages and decrypt them [2].”
From A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3 (2018) · cites this paper as [2]
KRACK exploits the four-way handshake that wireless security protocols use to authenticate users when connecting to the network.
“This process exploits the four-way handshake that wireless security protocols use to authenticate their users when connecting to the network.”
From A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3 (2018) · cites this paper as [2]
WPA2 can be exploited by KRACK.
“It has also been demonstrated that WPA2 can be exploited by a method known as KRACK, for which we will go into further depth in Section 4.2.7.”
From A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3 (2018) · cites this paper as [2]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Entity Authentication and Key Distribution
Bellare, M., & Rogaway, P. (2007) · Lecture Notes in Computer Science · doi:10.1007/3-540-48329-2_21 · Cited by 1,752 · see citing works
Weaknesses in the Key Scheduling Algorithm of RC4
Fluhrer, S. R., Mantin, I., & Shamir, A. (2001) · Lecture notes in computer science · doi:10.1007/3-540-45537-x_1 · Cited by 1,044 · see citing works
Intercepting mobile communications
Borisov, N., Goldberg, I., & Wagner, D. A. (2001) · Proceedings of the 28th Annual International Conference on Mobile Computing And Networking · doi:10.1145/381677.381695 · Cited by 837 · see citing works
Wormhole attacks in wireless networks
Hu, Y., Perrig, A., & Johnson, D. B. (2006) · IEEE Journal on Selected Areas in Communications · doi:10.1109/jsac.2005.861394 · Cited by 660 · see citing works
Network Time Protocol Version 4: Protocol and Algorithms Specification
Mills, D. L., Burbank, J. L., & Kasch, W. (2010) · doi:10.17487/rfc5905 · Cited by 582 · see citing works
Recommendation for block cipher modes of operation :
Dworkin, M. J. (2007) · doi:10.6028/nist.sp.800-38c · Cited by 307 · see citing works
Practical attacks against WEP and WPA
Tews, E., & Beck, M. (2009) · doi:10.1145/1514274.1514286 · Cited by 259 · see citing works
A Messy State of the Union: Taming the Composite State Machines of TLS
Beurdouche, B., Bhargavan, K., Delignat-Lavaud, A., Cédric Fournet, A., Kohlweiss, M., Pironti, A., Strub, P.-Y., & Zinzindohoué, J. K. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.39 · Cited by 221 · see citing works
SECURITY ANALYSIS AND IMPROVEMENTS FOR IEEE 802.11I
He, C., & Mitchell, J. C. (2005) · Cited by 220 · see citing works
Protocol state fuzzing of TLS implementations
de Ruiter, J., & Poll, E. (2015) · University of Birmingham Research Portal (University of Birmingham) · Cited by 191 · see citing works
Analysis of the 802.11i 4-way handshake
He, C., & Mitchell, J. C. (2004) · Proceedings of the 3rd ACM workshop on Wireless security · doi:10.1145/1023646.1023655 · Cited by 159 · see citing works
TCP/IP security threats and attack methods
Harris, B., & Hunt, R. (1999) · Computer Communications · doi:10.1016/s0140-3664(99)00064-x · Cited by 157 · see citing works
Advanced Wi-Fi attacks using commodity hardware
Vanhoef, M., & Piessens, F. (2014) · Proceedings of the 30th Annual Computer Security Applications Conference · doi:10.1145/2664243.2664260 · Cited by 152 · see citing works
Self-citationOn the Practical (In-)Security of 64-bit Block Ciphers
Bhargavan, K., & Leurent, G. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978423 · Cited by 152 · see citing works
AlFardan, N. J., Bernstein, D. J., Paterson, K. G., et al. (2013) · TU/e Research Portal · Cited by 132 · see citing works
A modular correctness proof of IEEE 802.11i and TLS
He, C., Sundararajan, M., Datta, A., Derek, A., & Mitchell, J. C. (2005) · Proceedings of the 12th ACM conference on Computer and communications security · doi:10.1145/1102120.1102124 · Cited by 121 · see citing works
Systematic Fuzzing and Testing of TLS Libraries
Somorovsky, J. (2016) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2976749.2978411 · Cited by 115 · see citing works
Attacking the Network Time Protocol
Malhotra, A., Cohen, I. E., Brakke, E., et al. (2016) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2016.23090 · Cited by 80 · see citing works
On the Security of CTR + CBC-MAC
Jönsson, J. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36492-7_7 · Cited by 76 · see citing works
All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and {TLS}
Vanhoef, M., & Piessens, F. (2016) · Lirias · Cited by 65 · see citing works
Self-citationNonce-Disrespecting Adversaries:Practical Forgery Attacks on GCM in TLSPreprint
Böck, H., Zauner, A., Devlin, S., et al. (2017) · IACR Cryptology ePrint Archive · doi:10.5281/zenodo.3610301 · Cited by 50 · see citing works
A Practical, Targeted, and Stealthy Attack Against WPA Enterprise Authentication.
Cassola, A., Robertson, W., Kirda, E., et al. (2013) · Cited by 46 · see citing works
Practical verification of WPA-TKIP vulnerabilities
Vanhoef, M., & Piessens, F. (2013) · doi:10.1145/2484313.2484368 · Cited by 44 · see citing works
Self-citationPerformance study of fast BSS transition using IEEE 802.11r
Bangolae, S., Bell, C., & Qi, E. (2006) · International Conference on Wireless Communications and Mobile Computing · doi:10.1145/1143549.1143696 · Cited by 43 · see citing works
Plaintext Recovery Attacks Against WPA/TKIP
Paterson, K. G., Poettering, B., & Schuldt, J. C. N. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-46706-0_17 · Cited by 34 · see citing works
A practical investigation of identity theft vulnerabilities in Eduroam
Brenza, S., Pawlowski, A., & Pöpper, C. (2015) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/2766498.2766512 · Cited by 32 · see citing works
A Critique of CCM.Preprint
Rogaway, P., & Wagner, D. A. (2003) · IACR Cryptology ePrint Archive · Cited by 28 · see citing works
Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys
Vanhoef, M., & Piessens, F. (2016) · Lirias · Cited by 26 · see citing works
Self-citationDiscovering and exploiting 802.11 wireless driver vulnerabilities
Butti, L., & Tinnés, J. (2007) · Journal of Computer Virology and Hacking Techniques · doi:10.1007/s11416-007-0065-x · Cited by 26 · see citing works
Attacking NTP's Authenticated Broadcast Mode
Malhotra, A., & Goldberg, S. (2016) · ACM SIGCOMM Computer Communication Review · doi:10.1145/2935634.2935637 · Cited by 23 · see citing works
Falsification Attacks against WPA-TKIP in a Realistic Environment
Todo, Y., Ozawa, Y., Ohigashi, T., et al. (2012) · IEICE Transactions on Information and Systems · doi:10.1587/transinf.e95.d.588 · Cited by 21 · see citing works
On the Security of the CCM Encryption Mode and of a Slight Variant
Fouque, P.-A., Martinet, G., Valette, F., & Zimmer, S. (2008) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-68914-0_25 · Cited by 20 · see citing works
Halvorsen, F. M., Haugen, O., Eian, M., et al. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04766-4_9 · Cited by 20 · see citing works
The Fragility of AES-GCM Authentication Algorithm
Gueron, S., & Krasnov, V. (2014) · International Conference on Information Technology: New Generations · doi:10.1109/itng.2014.31 · Cited by 17 · see citing works
Robyns, P., Bonné, B., Quax, P., & Lamotte, W. (2014) · ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec) · doi:10.1145/2627393.2627411 · Cited by 16 · see citing works
Scrutinizing WPA2 password generating algorithms in wireless routers
Lorente, E. N., Meijer, C., & Verdult, R. (2015) · Cited by 15 · see citing works
On the fast BSS transition algorithms in the IEEE 802.11r local area wireless networks
Machań, P., & Woźniak, J. (2011) · Telecommunication Systems · doi:10.1007/s11235-011-9590-5 · Cited by 15 · see citing works
Nonce Generators and the Nonce Reset Problem
Zenner, E. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04474-8_33 · Cited by 14 · see citing works
Flagged first, then by citations
Research works printed but not linked: 15
- IEEE Std 802.
- IEEE Std 802.11ac. 2013. Amendment 4: Enhancements for Very High Throughput for Operation in Bands below 6 GHz.
- IEEE Std 802.11ad. 2012. Amendment 3: Enhancements for Very High Throughput in the 60 GHz Band.
- IEEE Std 802.11i. 2004. Amendment 6: Medium Access Control (MAC) Security Enhancements.
- IEEE Std 802.11r. 2008. Amendment 2: Fast Basic Service Set (BSS) Transition.
- Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J Alex Halderman, Viktor Dukhovni, et al. 2016. DROWN: breaking TLS using SSLv2. In USENIX Security.
- Nikita Borisov, Ian Goldberg, and David Wagner. 2001. Analysis of 802.11 Security, or Wired Equivalent Privacy Isn't. In Mac Crypto Workshop.
- Alessandro Cimatti, Edmund Clarke, Enrico Giunchiglia, Fausto Giunchiglia, Marco Pistore, Marco Roveri, Roberto Sebastiani, and Armando Tacchella. 2002. Nusmv 2: An opensource tool for symbolic model checking. In International Conference on Computer Aided Verification. Springer.
- David L Mills. 2011. Computer network time synchronization (2 ed.). CRC Press.
- Grand View Research. 2017. Wireless Gigabit (WiGig) Market Size To Reach $7.42 Billion By 2024. (2017). Retrieved May 10, 2017 from http://www. grandviewresearch.com/press-release/global-wireless-gigabit-wigig-market
- J. Selvi. 2015. Breaking SSL using time synchronisation attacks. In DEF CON Hacking Conference.
- Robert Stacey, Adrian Stephens, Jesse Walker, Herbert Liondas, and Emily Qi. 2010. Rekeying Protocol Fix. (2010). Retrieved August 19, 2017 from https:// mentor.ieee.org/802.11/dcn/10/11-10-0313-01-000m-rekeying-protocol-fix.ppt
- Robert Stacey, Adrian Stephens, Jesse Walker, Herbert Liondas, and Emily Qi. 2010. Rekeying Protocol Fix Text. (2010). Retrieved August 19, 2017 from https://mentor. ieee.org/802.11/dcn/10/11-10-0314-00-000m-rekeying-protocol-fix-text.doc
- Adam Stubblefield, John Ioannidis, Aviel D Rubin, et al. 2002. Using the Fluhrer, Mantin, and Shamir Attack to Break WEP. In NDSS.
- Joshua Wright. 2003. Weaknesses in LEAP challenge/response. In DEF CON Hacking Conference.
Cited by
Sorted by citations
Security and privacy issues of UAV: A survey
Zhi, Y., Fu, Z., Sun, X., & Yu, J. (2020) · Mobile Networks and Applications · doi:10.1007/s11036-018-1193-x · Cited by 226 · see citing works
Dragonblood: Analyzing the Dragonfly Handshake of WPA3 and EAP-pwd
Vanhoef, M., & Ronen, E. (2020) · 2020 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp40000.2020.00031 · Cited by 179 · see citing works
Self-citationLiu, X., Qian, C., Hatcher, W. G., Xu, H., Liao, W., & Yu, W. (2019) · IEEE Access · doi:10.1109/access.2019.2920763 · Cited by 152 · see citing works
A Comprehensive Attack Flow Model and Security Analysis for Wi-Fi and WPA3
Kohlios, C. P., & Hayajneh, T. (2018) · Electronics · doi:10.3390/electronics7110284 · Cited by 77 · see citing works
“Each attack will be described in detail and analyzed, including the new Key Re-installation Attack (KRACK) exploit released in 2017 [2] and the recent PMKID attack released in 2018 [3].”
BackgroundInfluentialMulti-Channel Man-in-the-Middle attacks against protected Wi-Fi networks: A state of the art review
Thankappan, M., Rifà-Pous, H., & Garrigues, C. (2022) · Expert Systems with Applications · doi:10.1016/j.eswa.2022.118401 · Cited by 59 · see citing works
Wireless Networks and Critical Information Infrastructure
Illesi, Z., Halasz, A., & Janos Varga, P. (2018) · 2018 IEEE 12th International Symposium on Applied Computational Intelligence and Informatics (SACI) · doi:10.1109/saci.2018.8441023 · Cited by 11 · see citing works
Uncovering Practical Security and Privacy Threats for Connected Glasses with Embedded Video Cameras
Opaschi, O., & Vatavu, R.-D. (2020) · Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies · doi:10.1145/3432700 · Cited by 10 · see citing works
Responding to KRACK: Wi-Fi Security Awareness in Private Households
Freudenreich, J., Weidman, J., & Grossklags, J. (2020) · IFIP advances in information and communication technology · doi:10.1007/978-3-030-57404-8_18 · Cited by 9 · see citing works
Reyes-Moncayo, H. I., Malaver- Mendoza, L. D., & Ochoa-Murillo, A. L. (2020) · Scientia et technica · doi:10.22517/23447214.23781 · Cited by 3 · see citing works
Secure and Efficient Block Cipher Mode Design for Parallel Processing and Reliable Security
Vatsavayi, V. K., & Bommireddy, D. R. (2026) · Cryptography · doi:10.3390/cryptography10010013 · Cited by 2 · see citing works
- Authors
- Vanhoef, M., & Piessens, F.
- Affiliations
- IMEC (BE)
- Venue
- Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security
- Publisher
- ACM
- Published
- 2017-10-30
- Pages
- 1313-1328
- ISSN
- 1543-7221 (ISSN-L)
- OpenAlex
- W2767098552
- Cited by
- 380
- References
- 38
- Citations by year
- 2026: 25 · 2025: 31 · 2024: 38 · 2023: 42 · 2022: 40 · 2021: 35 · 2020: 53 · 2019: 55 · 2018: 59 · 2017: 2
- FWCI
- 21.08
- Type
- conference paper
- Language
- en
- Open access
- green
- lirias.kuleuven.be
- Locations
- ACM SIGSAC Conference on Computer and Communications Security (CCS) (publishedVersion)
- Lirias (KU Leuven) (submittedVersion, other-oa)
- Funders
- KU Leuven
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
- Physical Sciences › Computer Science › Computer Networks and Communications › Wireless Networks and Protocols
- Keywords
- Wi-Fi security, 4-way handshake, replay attacks, group key
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
