Wireless Network Security: WPA2 4-Way Handshake Cracking, KRACK Attacks & WPA3 SAE Dragonfly Exchange

1. Evolution of 802.11 Wi-Fi Cryptographic Standards

Wireless local area networks (WLANs) transmit data across the open electromagnetic spectrum, eliminating physical boundary controls. As a result, 802.11 security relies entirely on cryptographic encapsulation protocols. The evolution of Wi-Fi security spans four generations:

• WEP (Wired Equivalent Privacy): Utilized RC4 stream cipher with a static 24-bit Initialization Vector (IV). The small IV space guarantees IV collision within minutes, allowing deterministic mathematical key recovery via the Fluhrer-Mantin-Shamir (FMS) attack.
• WPA (Wi-Fi Protected Access): An interim standard introducing the Temporal Key Integrity Protocol (TKIP) and Per-Packet Key Mixing, preserving legacy WEP hardware while fixing immediate key reuse vulnerabilities.
• WPA2 (802.11i): Mandated AES-CCMP (Counter Mode CBC-MAC Protocol). Highly secure in data confidentiality, but vulnerable to pre-shared key (PSK) offline dictionary attacks via 4-way handshake interception.
• WPA3 (802.11ax/be): Replaces PSK with Simultaneous Authentication of Equals (SAE) based on the Dragonfly handshake, eliminating offline dictionary attacks and providing forward secrecy.

2. Anatomy of the WPA2 4-Way Handshake

The WPA2 4-Way Handshake establishes dynamic, temporary session keys between the Client Station (STA) and the Access Point (AP) without transmitting the master Pre-Shared Key (PSK) over the air:

1. The Pairwise Master Key (PMK) is derived once: ( text{PMK} = text{PBKDF2}(text{HMAC-SHA1}, text{Passphrase}, text{SSID}, 4096, 256) ).
2. Message 1 (AP → STA): The AP generates a cryptographically random Authenticator Nonce (ANonce) and transmits it to the STA.
3. Message 2 (STA → AP): The STA generates a Supplicant Nonce (SNonce). The STA computes the Pairwise Transient Key (PTK):

   PTK = PRF-512(PMK, "Pairwise key expansion", Min(AA, SA) || Max(AA, SA) || Min(ANonce, SNonce) || Max(ANonce, SNonce))

   The PTK is split into KCK (Key Confirmation Key), KEK (Key Encryption Key), and TK (Temporal Key). The STA sends SNonce along with a Message Integrity Check (MIC) computed with the KCK.

4. Message 3 (AP → STA): The AP verifies the MIC, derives the identical PTK, and sends the Group Temporal Key (GTK) encrypted with KEK, plus a valid MIC.
5. Message 4 (STA → AP): The STA acknowledges receipt of the GTK, confirming the PTK is active.

+----------------+                                   +----------------+
|  Client (STA)  |                                   |  Access Point  |
+----------------+                                   +----------------+
        |                                                    |
        |  |
        |                                                    |
        |                                                Verify MIC
        |                                                Derive PTK
        |  |
        |                                                    |
 [ Encrypted AES-CCMP Communications Established ]

3. WPA2 Attack Vectors: EAPOL Sniffing, PMKID & KRACK

A. Offline Dictionary Attacks via Handshake Interception

An attacker captures Messages 1 and 2 by listening passively or actively deauthenticating clients using 802.11 deauth frames (aireplay-ng -0). Once captured, the attacker conducts an offline brute-force or wordlist attack against the MIC without interacting with the network.

B. The PMKID Attack

Discovered by atom (hashcat lead developer) in 2018, attackers can retrieve the Pairwise Master Key Identifier (PMKID) from the very first EAPOL frame of modern APs supporting 802.11r (Fast BSS Transition) without waiting for a client to connect:

PMKID = HMAC-SHA1-128(PMK, "PMK Name" || MAC_AP || MAC_STA)

This allows capturing the crackable material from an empty access point in less than five seconds using hcxdumptool.

C. The KRACK Attack (Key Reinstallation Attack)

Discovered by Mathy Vanhoef (CVE-2017-13077), KRACK exploits a state-machine flaw in the 802.11i standard. When Message 3 of the 4-way handshake is retransmitted due to dropped packets, the client station reinstalls the already-in-use Temporal Key (TK), which resets the incremental packet number (nonce) to zero. Nonce reuse in AES-CCMP and ChaCha20 completely destroys keystream confidentiality, enabling traffic decryption and TCP packet injection.

4. WPA3 Simultaneous Authentication of Equals (SAE) Dragonfly Handshake

WPA3 resolves the vulnerabilities of WPA2 by replacing PSK with Simultaneous Authentication of Equals (SAE), based on RFC 7664 (Dragonfly Key Exchange). SAE uses zero-knowledge proof concepts based on discrete logarithms in elliptic curves (ECC):

• Immunity to Offline Dictionary Attacks: During the SAE handshake, the secret password is used to map a point onto an elliptic curve (Password Element / PWE). Even if an adversary captures all frames exchanged over the air, they cannot verify whether a candidate password is correct without conducting an online attack directly against the AP.
• Forward Secrecy: Each connection generates ephemeral Diffie-Hellman keys. Even if the network passphrase is compromised in the future, past captured traffic cannot be decrypted.
• Protected Management Frames (PMF / 802.11w): WPA3 mandates 802.11w, cryptographically signing deauthentication, disassociation, and action frames, completely preventing wireless denial-of-service deauth attacks.

5. Hands-on Wireless Packet Triage in Python

The following Python script utilizes Scapy to monitor 802.11 beacon frames and audit wireless networks for the presence of 802.11w Protected Management Frames (PMF) and WPA3 SAE capabilities.

# 802.11 Wireless Security Auditor using Scapy
from scapy.all import sniff, Dot11, Dot11Beacon, Dot11Elt
import sys

discovered_aps = {}

def audit_wifi_frame(packet):
    if packet.haslayer(Dot11Beacon):
        bssid = packet[Dot11].addr2
        if bssid in discovered_aps:
            return

        # Extract SSID
        ssid = packet[Dot11Elt].info.decode(errors="ignore") if packet.haslayer(Dot11Elt) else "HIDDEN"
        
        # Parse Information Elements (IE)
        rsn_found = False
        pmf_capable = False
        pmf_required = False
        wpa3_sae = False

        elt = packet.getlayer(Dot11Elt)
        while elt:
            # IE Tag 48 = RSN (Robust Security Network / WPA2/WPA3)
            if elt.ID == 48:
                rsn_found = True
                rsn_data = bytes(elt.info)
                
                # Check RSN Capabilities (2 bytes at offset 8 if present)
                if len(rsn_data) >= 10:
                    rsn_cap = int.from_bytes(rsn_data[8:10], byteorder="little")
                    # Bit 7: Management Frame Protection Capable (MFPC)
                    # Bit 6: Management Frame Protection Required (MFPR)
                    pmf_capable = bool(rsn_cap & (1 << 7))
                    pmf_required = bool(rsn_cap & (1 << 6))

                # Check AKM Suite for SAE (WPA3)
                if b"x00x0fxacx08" in rsn_data:
                    wpa3_sae = True

            elt = elt.payload.getlayer(Dot11Elt)

        discovered_aps[bssid] = {
            "ssid": ssid,
            "rsn": rsn_found,
            "pmf_capable": pmf_capable,
            "pmf_required": pmf_required,
            "wpa3": wpa3_sae
        }

        print(f"[*] Discovered AP: {ssid} ({bssid})")
        print(f"    - WPA3 SAE Enabled: {wpa3_sae}")
        print(f"    - PMF (802.11w) Capable: {pmf_capable} | Required: {pmf_required}")

if __name__ == "__main__":
    print("[*] Listening on mon0 for 802.11 Beacon Frames...")
    # Requires network card in monitor mode
    try:
        sniff(iface="mon0", prn=audit_wifi_frame, count=50, timeout=30)
    except Exception as e:
        print(f"[-] Interface error: {e}")

6. Enterprise WLAN Hardening Guidelines

• Transition to WPA3-Enterprise 192-bit Mode: In high-compliance enterprise networks, mandate WPA3-Enterprise utilizing Suite B Cryptography (EAP-TLS with ECDSA P-384 and AES-256-GCM).
• Enforce 802.11w Protected Management Frames: Set PMF to “Required” across all production SSIDs to stop deauthentication denial-of-service and rogue Evil Twin attacks.
• Decommission WPA-TKIP and WEP: Ensure all access points have legacy TKIP cipher suites completely disabled, as TKIP introduces vulnerabilities that degrade throughput and security.
• Isolate Guest Networks via VLANs & Client Isolation: Prevent wireless lateral movement by configuring Layer 2 Client Isolation on guest SSIDs and routing guest traffic directly through an isolated DMZ firewall interface.

Threat Hunting & Strategic Attribution Playbook

Converting forensic findings into actionable threat intelligence requires rigorous adherence to intelligence analysis standards:

1. Diamond Model Activity Threading: Correlate the observed adversary capability (malware, exploits) and infrastructure (C2 domains, IP blocks, JARM hashes) against known threat actor profiles in MITRE ATT&CK. Establish analytical confidence using the Admiralty Code.
2. Passive DNS & Infrastructure Pivoting: Query historical passive DNS (pDNS) repositories to map the attacker’s broader hosting topology. Identify SSL/TLS certificate reuse, common WHOIS registrant attributes, and co-located command servers.
3. Defensive Engineering via MITRE D3FEND: Map identified adversary TTPs to corresponding D3FEND defensive countermeasures. Deploy canary credentials, harden process execution policies, and implement network micro-segmentation to permanently deny the threat actor operational access.
4. Automated STIX/TAXII Threat Sharing: Package validated threat intelligence into standardized STIX 2.1 JSON bundles. Automate TAXII feed publication to SIEM, SOAR, and perimeter firewall blocklists for automated threat neutralization.