Paper 2013/425

Break WEP Faster with Statistical Analysis

Rafik Chaabouni

Abstract

The Wired Equivalent Protocol is nowadays considered as unsafe. However the only academic research that tries to break WEP has been done by Fluhrer, Mantin and Shamir, who have published a report on a specific attack. Nevertheless, an unknown person under the pseudonym Korek has published 17 attacks, which are now used by both AirCrack and WepLab. For a network with average load traffic, the FMS attack would need roughfly 40 days in order to find the key (4 millions packets needed), whereas Korek's attacks in addition to stimulation of the network load, reduce this time under 15 minutes (325'000 packets needed) for a 128 bits key (104 bits secret key). We analyzed these attacks, gave a mathematical description of them and explained a new attack, in order to identify new ones.

Note: This is an unpublished student project from 2006. The sole two reasons that I bring back this report here are: 1) this is the only report presenting the Korek attacks in full details. 2) this report is still requested and getting some attention (still currently cited, in 2013)