Hello and welcome to this video titled WPA3, Perfect Forward Secrecy.
In order to explain the concept of perfect forward secrecy, we first of
all have to understand what the word forward means in that term.
So as this says in cryptography, the terms forward or backward as applied
to the secrecy of data is determined if the moment of compromise is in
front of or behind the data that remains protected.
So we're comparing two things.
Where the moment of compromise happens and are we talking about data that
from that point on is protected or data that's behind that moment of compromise
being protected.
Here's an example.
Here's our timeline.
Here's data going through it.
Let's say that right now at that moment, there's a key compromise.
And so that malicious hacker is able to spot your EAP over land, four
way handshake and somehow figure out your pairwise transient key.
And then the three keys are derived from that.
So if we have some sort of algorithm that says the set of data below on
the right is maintained in secrecy, well, the compromise occurred behind
or in the back of the data.
So we would call that backward secrecy.
If the data, if the compromise occurs in front of data, and that data
is protected, so if the data on the left is protected, so all the data
from the past, we call that forward secrecy.
I know it sounds kind of odd.
I used to think that perfect forward secrecy meant, okay, well, if there's
a compromise, then that means all the data that is exchanged after that
compromise is protected.
That's not what this means.
Let me give you another definition of this.
So perfect forward secrecy as a whole refers to cryptographic key exchange
protocols. For example, ephemeral Diffie -Hellman used in WPA three, where
the compromise of long term keys, and that's critical there that term
long term keys, if those are compromised, they cannot be used to recover
any past session keys.
So even if an attacker recorded the EAP over land key handshake message,
past data is still protected.
So what do we mean by long term keys in this case?
So in this context, a long term key refers to secret information that
does not change over time.
For example, in WPA two, the pre shared key is considered a long term
key. If you're connecting to a WPA to wireless LAN, the pre shared key
might be Cisco 123.
Everybody gets that pre shared key, and that pre shared key is directly
related via formula to the pairwise master key.
You can do it just by following the formula.
And the pairwise master key is always the exact same thing.
So that's what we see here too.
In WPA two, the pairwise master key does not change.
And everybody has the exact same pairwise master key that's connecting
to that WPA two personal wireless LAN.
Now, is there a long term key in the context of WPA three?
Yes, you need a passphrase to connect.
But the pairwise master key is not considered a long term key, because
that changes. Every every person has a different pairwise master key.
And every time you connect to that wireless LAN, you get a different pairwise
master key does not consider a long term key.
Okay, so in WPA three, if an attacker captures your data for some time,
and then later cracks the encryption key, which would be very difficult,
only data after the key has been cracked is at risk.
So even if they've been capturing, let's say they've been capturing three
days of Wi-Fi data.
And during those three days, you have associated and disassociated from
that wireless LAN seven or eight times, and they've captured all of that.
Now, they they stop their recent time that you connected to that wireless
LAN. So they see the, you know, the, the, the uh, EAP over LAN handshake.
And somehow from that, they are able to figure out what your pairwise
transient key is.
They extract from that the, uh, the temporal key that you use to encrypt
and decrypt data, which means from that moment on, for that particular
session, they can encrypt, they, I should say they can decrypt all the
data that they caught from you, but they can't use that in any way to
decrypt the sessions before that.
So all those six or seven sessions when you connected and disconnected
prior to that, the decryption is not going to help them in that particular
case. So that's why we call it perfect forward secrecy.
Now you might be wondering, well, what about WPA two?
Doesn't that provide perfect forward secrecy?
No, it doesn't. So I'm going to show you here a classic attack against
WPA two called an offline dictionary attack and why this translates to
WPA two personal, not providing perfect forward secrecy.
All right, so let's say that a malicious actor starts watching and collecting
all of your Wi-Fi frames on a particular channel on a particular SSID.
So what do they see?
They see the EAP over land message one, two, three, and four.
So based on what they've seen here, what do they know?
What are they able to collect?
The things here, they can collect all the stuff in that those messages.
The only thing they don't know so far is the pairwise master key.
And that's their objective.
They want to figure out what that pairwise master key is, because if they
can figure that out successfully, they can do one of, they can do two
different things with it.
Number one, if they can figure out the pairwise master key, they can reverse
engineer the WPA two passphrase, or I should say the pre shared key like
coffee 123 or INE 123, because that passphrase directly created that PMK.
So if they can figure out the PMK, they can figure out the passphrase.
And now they can join the wireless LAN, and they can connect to it wire
lessly and associate also, even more critically, if they're able to crack
the PMK. And then they have these values here for this particular session
from this client, they can also crack the pairwise transient key for this
session here. And then they can subsequently get down to the temporal
key, the key encryption key, and the other thing.
So how are they going to go about doing that?
All right, so in an offline dictionary attack, the malicious actor will
have what's called an offline dictionary.
This is basically just a software database of of thousands or even millions
of passwords or potential passwords that they've downloaded off the dark
web or wherever they've gotten it from.
All right, so they're going to start going to that dictionary, and they're
going to retrieve from it the very first item, whatever that is, maybe
it's password 123, whatever the first item is in that list of millions
of potential passwords.
And they're going to say, Okay, I'm going to see if this is the WPA to
pre shared key, like coffee 123 for this particular wireless LAN, let's
see if it is. So they're going to pass that password, that dictionary
item, into the PBK DF to algorithm, which is what WPA to uses to derive
its pairwise master key.
Okay, so once they pass that first dictionary item into the PBK DF to
algorithm, it's going to spit out some output, some value, which might
be which is a potential pairwise master key.
How do we know if it's the real one, the accurate one for this particular
WPA to wireless LAN?
Well, the attacker knows how the PRF 512 algorithm works.
It works by sort of concatenating all these things together.
Now, from pairwise key expansion, that text string onto the right, they've
already gotten this stuff because they saw the four way EAP over LAN handshake.
They saw the MAC addresses that the two stations, the station, the access
point, they saw the nonces, the A nonce and the S down that they got all
that the only thing they didn't have was the PMK.
So they're saying, okay, I've taken a dictionary item.
I've turned it into a potential PMK by passing it through the exact same
algorithm that a normal client would.
I'm going to put it in here.
And I'm going to so it's going to end up looking like this.
I'm going to run this through the HMAC Shaw one algorithm.
That's what WPA two clients do.
And that's going to give me four outputs.
I'm going to concatenate together, strip off the end of it.
And that's going to provide for me a 512 bit value, which might be the
pairwise transient key.
Maybe it's a potential match.
How do we find out if it's a real match?
Well, now we take that potential pairwise transient key that we created.
And we're going to, we know that the structure of it is like this, we
know that the first third of it is the key confirmation key.
So we say, okay, this might be the key confirmation key.
So what I'm going to do is I'm going to take a look at that EPO over land
handshake that I caught.
I see there's mik values in there.
Those mik values are computed by taking all the data in the message and
running it through a hashing algorithm with this key confirmation key.
So it says, okay, can I use the key confirmation key I came up with, apply
it to this exact same data using the exact same normal formula and come
up with the exact same mik value.
If I can, that means I figured it out.
I've got the pairwise transient key for this particular session, which
was derived from the pairwise master key.
So now I can decode decrypt all the data from this session onwards.
Also, I can join this wireless land myself because I have the pairwise
master key. And I know that that was derived from dictionary item number
one. Therefore dictionary item number one must be the WPA two passphrase.
Now, if the answer is no, which most likely it's not, you're probably
not going to get it on the first try.
Try again, pull dictionary item number two and do this potentially thousands
of times. Hey, it might take you several hours.
But if you get it working, if after a few hours or a day or so of trying
out millions of combinations, you're able to crack this.
Now, not only can you decrypt all the session data from that particular
Wi-Fi client that you captured, you can now get onto that Wi-Fi and you
can have it free of charge for yourself.
So WPA two, as we look at the perfect forward secrecy.
Once the malicious actor has decoded that, that pre shared key, he knows
that he knows what the pairwise master key will always be.
It's always going to be static and unchanging.
That's the nature of WPA two.
So therefore, he can go back in time and look at all the captured Wi-Fi
sessions for this client.
And as long as he has the EPU over land four way handshake, he can crack
all those sessions and decrypt all that past data from that client.
So this all hinged on the malicious actor being able to figure out what
the pairwise master key was.
And we saw that with a little bit of effort with WPA two, he was able
to figure that out.
What about WPA three?
Now, WPA three is advertises having perfect forward secrecy, which means
in theory, you can't do that.
And also in theory, even if somehow you were able to crack the pairwise
master key for a particular session, that wouldn't help you for the previous
sessions before that.
Why not? Well, we know that the key to cracking a Wi-Fi session, decrypting
data and to getting on the wireless LAN yourself is to obtain the pairwise
master key. Now, we found out in the previous slides there that WPA two's
PMK was directly computed from the PSK using that PBK DRF two formula.
And it never changes, which made it weak and crackable.
But let's think about how WPA three comes up with its pairwise master
key. First of all, is derived from the SAE dragonfly EDCH method.
Basically, it's using like a modified Diffie-Hellman method to come up
with the pairwise master key.
There's lots of formulas involved.
They're changing on every single time.
So every single time a client connects to the wireless LAN, that same
client on that same wireless LAN is going to get a different PMK.
So even if you crack it right now for his current session, that's not
going to help you for his previous sessions at all.
And secondly, how would you crack that?
Because the way that client came up with that PMK was using like random
numbers and exponents and things that were not exchanged at all during
the exchange of the values.
Yeah, if you actually captured the SAE handshake, you'll get, for example,
the scalar values and the finite field, the finite field element values.
But those were all created due to the pre-computations of the password
element and due to random exponential values, which are really huge and
pretty much impossible to reverse engineer.
So it's virtually impossible to crack what the pairwise master key is
that was used in any given WPA3 session.
And it changes every session.
And like I said, even as you were able to crack it for this particular
session right now, which would be very difficult, if not impossible, that
wouldn't help you for any previous sessions that you cracked.
And this is why we say the WPA3 has perfect forward secrecy.
Because even if you had that one in a billion shot of cracking a pairwise
master key for this one session, you would not be able to go back and
decrypt any previous session traffic that you had captured because that
had a completely different set of keys.
And that is the definition of perfect forward secrecy.
So thank you so much for watching.
And I really hope this presentation was helpful.