Is WPA2 security broken due to Defcon MS-CHAPv2 cracking?

http://revolutionwifi.blogspot.com/2012/07/is-wpa2-security-broken-due-to-defcon.html

by alter8 • 14 years ago

38 15 14 years ago

revolutionwifi.blogspot.com

ojno• 14 years ago

Flamebait title -- the answer at the end of the article is "No." :-P

wlesieutre2• 14 years ago

Betteridge's Law of Headlines in action!

corin_• 14 years ago

Does this really need to be brought up every single time a submission has a question in the title?

alter8• 14 years ago

I could put the answer in the title, but it would get edited back to OP's title.

jrockway• 14 years ago

Actually, it's the first line of the article.

UnoriginalGuy• 14 years ago

MS-CHAPv2 is used by VPNs and can be used by RADIUS authentication services (to authenticate WIFI clients) but typically it won't be.

For almost all private individuals your WPA2 connection is still just as secure as it has ever been. For most businesses it is likely secure unless you're using a Microsoft RADIUS server for authentication (and even then as the article says the impact is almost nil).

Which isn't to say that the MS-CHAPv2 thing isn't a big deal: because it really is. It just doesn't have much to do with WIFI.

peterwwillis3• 14 years ago

As part of the new Baseline Requirements for public CAs, certificate authorities are not able to issue certificates for internal purposes after 2015.

This means that your client will have to have the certificate installed on it prior to authentication. So a random person connecting to your AP may be subject to an untrusted certificate, or require manual installation before connecting.

So.... in 2015, we might be fucked.

apendleton• 14 years ago

This article assumes self-signed certs anyway, and specifically addresses procedures for disseminating them.

peterwwillis3• 14 years ago

The article mentions how to work with self-signed certs, but that is not the point. Many orgs don't run their own root CA because the cost of supporting all the devices just to auth securely is overwhelming, and just buying one cert from VeriSign is enough to keep it secure. Except when 2015 rolls around. If you maintain wireless networks for large enterprises, it's kind of a big deal.

comex2• 14 years ago

Can't you get around that by just using a real domain name? There's no requirement that the server be accessible externally.

peterwwillis3• 14 years ago

There's no guarantee the CA won't revoke it if they find out you're using it for internal purposes.

moxie• 14 years ago

It's also probably worth acknowledging that many organizations do use MS-CHAPv2 for their inner authentication credentials, precisely because they want to depend on it for mutual authentication instead of managing/deploying a PKI.

Since the Defcon talk, I've gotten a ton of emails from people thanking me for making this available as a service, so that they can easily demonstrate why relying on MS-CHAPv2 for WPA2 mutual authentication is a bad idea to their organizations.

The article is correct, but the solution they outline is only "simple" in theory. Most organizations do not have a BYOD enforcement or onboarding process for their enterprise wireless networks, and they used to think MS-CHAPv2 made that OK.

Is WPA2 security broken due to Defcon MS-CHAPv2 cracking?

Related Stories