WPA3 documents and specifications

[kimocoder]

WPA3 specification sheet and documents may be found here

Just a informational notice. Thanks.

[ChrisLundquist]

WPA3 uses the dragonfly handshake which is designed to be resistant to offline dictionary attacks.
The existing WEP and WPA2 style attacks here can't easily be adapted.

[ChrisLundquist]

FWIW: https://tools.ietf.org/html/rfc7664 is the dragonfly KEX RFC
There was a small subgroup attack a few years back, but Dragonfly has been amended as a result.
https://eprint.iacr.org/2013/058.pdf (said attack)

[kimocoder]

There's a new method for WPA2 cracking available which was found under WPA3 cracking method researching.
Read more below

https://hashcat.net/forum/thread-7717.html

[kimocoder]

@kcdtv more notes which may be interesting for you to look at

[binarymaster]

https://hashcat.net/forum/thread-7717.html

tl;dr — PMKID = HMAC-SHA1-128(PMK, "PMK Name" | MAC_AP | MAC_STA)

I think a new feature request should be opened (to add the algorithm to aircrack-ng and notification into airodump-ng)

[ChrisLundquist]

Yeah, just to clarify: The above new attack applies to WPA2 while investigating WPA3. There still isn't a known (published) offline WPA3 attack.

[kimocoder]

New issue report / feature request opened. Thanks

[kcdtv]

Nice! Thanks so much kimocoder for letting me know about this new attack vs WPA2 and letting me know about this thread. I'll dive into that when i am back from holiday in a couple of weeks.
The first devices with WPA3 did come out this summer, in july, two qualcomm wifi chip:

• WCN3998 (mobile phone)
• PQ807x (router)
  I guess it will take some years before we start to seriously see WPA3 around us.
  Does anyone knows if something will appear soon in wpa_supplicant and hostapd?
  What i rode in the specification makes me thing that we might be lucky and that "getting around WPA3" might be doable. And maybe even more than what i thought, i have to check this new "handshakeless" attack versus WPA2.

[aircrack-ng]

SAE is already in mac80211 AFAIK since 802.11s already uses it. There are probably some adapation needed so no idea when WPA3 will land in wpa_supplicant. Following the commits in their repo would be the way to go by checking for test suite updates (wpa_supplicant and hostapd share some common code).

[kimocoder]

They've allready started the implementation on hostap & wpa_supplicant.
Commits are seen here

http://w1.fi/cgit/hostap/log/

[kcdtv]

I knew that both projects were launched originally by Jouni Malinen but i was not sure if he still was the wifi man. It looks like that is the case. Very good! The repo is still "w1.fi", some exiting testing to do. 😺

[kimocoder]

We got lots more information on several attack possibilities

Side-channel-attack and timing based attacks CVE-2019-9494

https://amp.thehackernews.com/thn/2019/04/wpa3-hack-wifi-password.html?__twitter_impression=true

[aircrack-ng]

There are some more details in this one: https://www.zdnet.com/article/dragonblood-vulnerabilities-disclosed-in-wifi-wpa3-standard/