Dragonblood: Attacking the Dragonfly Handshake of WPA3
summary
WPA3’s Dragonfly/SAE leaks a reproducible password “signature” via timing and cache side channels: timing side channel and flush+reload cache attack. On Raspberry Pi test hardware the attacker needs ~75 timing samples per spoofed MAC and about 17 spoofed MACs to single out a RockYou password; offline GPU code on EC2 cracks ~10^10 passwords for $1. Implementation bugs include invalid-curve checks (all 8 PWD implementations tested) and predictable RNG; repeated handshakes can CPU‑exhaust an AP (≈10–70 conn/s causes overload).
AI-written summary · about
chapters (16)
- 0:00Introduction to dragonfly
- 1:43Handshake security properties
- 4:34Dragonfly handshake process
- 6:18Password-to-group conversion
- 9:51Timing attacks on passwords
- 12:21MAC address spoofing
- 12:43Timing attack feasibility
- 15:01Elliptic curve vulnerabilities
- 17:00WPA3 defense mechanisms
- 22:46Cache-based side channels
- 24:27Optimizing password attacks
- 28:44Invalid curve attacks
- 30:30Randomness in WPA3
- 31:08Specific implementation bugs
- 34:48Denial of service attacks
- 37:10Downgrade attacks and conclusion
related talks
27mPredicting, Decrypting, and Abusing WPA2/802.11 Group Keys
43mSocial Forensication: A Multidisciplinary Approach to Successful Social Engineering
34mPractical Side-Channel Attacks Against WPA-TKIP
38m"Breaking Extreme Networks WingOS: How to own millions of..."
40m"It Me": Under the Hood of Web Authentication
47mKey Reinstallation Attacks: Breaking the WPA2 Protocol
21mSecurity is Everyone's Responsibility
59mHack Yourself First