edVirtus Reference

What Is KRACK?

How Did the KRACK Attack Exploit a Weakness in WPA2 Wi-Fi Security?

KRACK (Key Reinstallation Attack) is a cybersecurity vulnerability discovered in 2017 that exploits a weakness in the implementation of the Wi-Fi Protected Access II (WPA2) security protocol. By manipulating the four-way authentication handshake used to establish encrypted Wi-Fi communication, an attacker may be able to force a wireless device to reinstall an encryption key, making certain network traffic vulnerable to interception or manipulation.

The basic principle is straightforward. When a device connects to a secured Wi-Fi network, it performs a four-way handshake with the wireless access point to establish a shared encryption key. During this process, one of the protocol messages may be retransmitted if it appears to have been lost. KRACK exploits this retransmission mechanism by tricking the client device into reinstalling an encryption key that is already in use. This resets important encryption parameters, allowing some encrypted traffic to be decrypted, replayed, or modified under certain circumstances.

A useful analogy is resetting the page numbers in a numbered notebook while continuing to write new notes. If the numbering starts again from the beginning, pages become duplicated and confusion results. Similarly, reinstalling an encryption key resets values that are intended to remain unique, weakening the protection provided by the encryption system.

The attack affects the communication between a wireless client and an access point rather than the Wi-Fi password itself. An attacker must normally be within wireless range of the target network and actively intercept the communication during the connection process. KRACK does not reveal the Wi-Fi password or allow an attacker to join the network simply by exploiting the vulnerability.

The impact of KRACK depends on the operating system and software implementation. Some devices were vulnerable only to limited traffic interception, while others could be forced into using extremely weak encryption settings. Fortunately, the vulnerability was corrected primarily through software updates to client devices and wireless access points rather than requiring changes to the WPA2 standard itself.

It is important to distinguish KRACK from attacks that recover wireless passwords. KRACK does not crack or discover the WPA2 passphrase. Instead, it exploits the key management process that occurs after successful authentication. Likewise, KRACK differs from vulnerabilities in encryption algorithms such as AES, which remained cryptographically secure throughout the attack.

Today, KRACK serves as an important example of how secure cryptographic algorithms can still be compromised by weaknesses in protocol implementation. Following coordinated disclosure in 2017, operating system vendors, equipment manufacturers, and network administrators rapidly deployed software updates that largely mitigated the vulnerability. The incident highlighted the importance of secure protocol design, rigorous software testing, and timely security patching in protecting modern wireless communication systems.