KRACK (Key Reinstallation Attack)

KRACK, short for Key Reinstallation Attack, is not a bug in a single product but a flaw in the design logic of the WPA2 protocol itself — the encryption standard that had secured the vast majority of Wi-Fi networks since 2004. The attack targets the WPA2 “four-way handshake,” the process by which a client and access point confirm they both hold the correct pairwise key and negotiate a fresh encryption key for the session. By manipulating and replaying handshake messages, an attacker within physical Wi-Fi range of a victim can trick a device into reinstalling a key that is already in use, resetting the associated nonce (a number used once) and/or replay counters. Because WPA2's stream-cipher-style encryption depends on nonces never repeating, this reinstallation allows an attacker to decrypt packets, replay old traffic, and in some cases inject or forge new packets. On Android 6.0 and Linux systems running wpa_supplicant 2.4 or later, the flaw was especially severe: due to a separate implementation bug, those clients could be tricked into installing an all-zero encryption key, making decryption trivial.

Discovery and Disclosure

The vulnerability was found by Mathy Vanhoef, a security researcher at imec-DistriNet, KU Leuven in Belgium, reportedly while he was reviewing OpenBSD code for unrelated research. Vanhoef and his advisor Frank Piessens detailed the findings in the paper “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2.” Given the protocol-level and near-universal nature of the flaw, disclosure was coordinated: CERT/CC issued vendor notifications in mid-2017, with a broader round reportedly sent around August 28, 2017, and CERT/CC published advisory VU#228519. OpenBSD released a quiet patch in late August 2017, ahead of the coordinated public date, which reportedly created friction with other vendors still working under embargo. The vulnerability was publicly disclosed on October 16, 2017, via the krackattacks.com website and press coverage, with the academic paper formally presented at the ACM Conference on Computer and Communications Security (CCS) shortly after.

Affected CVEs and Impact

Ten CVE identifiers were assigned to cover the different handshakes and implementations affected: CVE-2017-13077 through CVE-2017-13082, and CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, and CVE-2017-13088 (13083 and 13085 were not used in the public set). These covered reinstallation attacks against the four-way handshake, group key handshake, Fast BSS Transition (FT) handshake, PeerKey handshake, TDLS, and WNM Sleep Mode frames. Because the weakness was in the protocol specification rather than one implementation, essentially every WPA2-capable device was potentially affected, including products from Microsoft, Apple, Google, Cisco, Broadcom, Intel, and countless router and IoT vendors.

Vendor Response

Following disclosure, vendors issued a wave of software and firmware patches; the Wi-Fi Alliance stated the issue could be resolved through backward-compatible software updates and added KRACK detection to its certification testing. Microsoft, Apple, and major Linux distributions shipped fixes within weeks, though many embedded and IoT devices remained unpatched for years afterward due to the difficulty of firmware updates across the supply chain.

Timeline

• 2017-07-14Mathy Vanhoef begins notifying affected vendors ahead of coordinated disclosure.
• 2017-08-28CERT/CC reportedly sends a broader round of vendor notifications about the vulnerability.
• 2017-08-30OpenBSD quietly ships a patch, ahead of the public coordinated-disclosure date.
• 2017-10-16Public disclosure of KRACK via krackattacks.com and CERT/CC advisory VU#228519; CVE-2017-13077 through CVE-2017-13088 (excluding 13083 and 13085) are published.
• 2017-11-01Vanhoef and Piessens present the paper "Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2" at the ACM Conference on Computer and Communications Security (CCS).
• 2017-11-16CERT/CC's VU#228519 advisory is last revised, reflecting updated vendor patch status.