KRACK: The Key Reinstallation Attack and What It Changed

KRACK was notable not because of the damage it caused — relatively little, in the end — but because of what it was: a flaw in the WPA2 protocol itself rather than in any implementation. The standard had been formally proven secure, and the proof did not cover the behaviour that broke.

The four-way handshake

After a client associates and the pre-shared key or enterprise authentication establishes a master key, WPA2 runs a four-message exchange to derive the session keys used to encrypt traffic.

The client confirms installation of the session key when it receives the third message. Because Wi-Fi is unreliable, the standard requires the client to accept a retransmission of that message and respond again — an access point that did not receive the acknowledgement will resend it.

That retransmission requirement is the flaw.

What replaying message three does

When a client receives message three, it installs the session key and resets the associated counters — the packet number used as a nonce, and the replay counter.

An attacker positioned between client and access point can block the client's acknowledgement and force the access point to retransmit message three. The client installs the same key again and resets the nonce to its starting value.

That is the break. The encryption modes used depend on a nonce never repeating with the same key. Reset it, and the keystream generated for packet one is reused for the next packet one — and reusing a keystream allows an attacker to recover plaintext by combining two ciphertexts encrypted with it.

The severity varied by client implementation. Against some, the practical result was decryption of traffic; against others, packet injection or forging; and one widely used client library reinstalled an all-zero key, which made decryption trivial.

Note what the attack does not do: it does not recover the Wi-Fi password. The master key is untouched. An attacker gets a position to decrypt some traffic on that session, and the network passphrase remains secret — which is why "change your Wi-Fi password" was the wrong advice at the time.

The constraints

KRACK requires the attacker to be within radio range and positioned between the client and the access point, typically by standing up a rogue access point on a different channel and relaying — the same positioning technique used in the evil twin family of attacks.

It targets the client rather than the access point in most variants, which determined the remediation path: the fix had to reach client devices, which is slower and less complete than patching infrastructure. Embedded and IoT devices in particular never received it.

And traffic already protected end to end — anything over TLS — remained protected, because decrypting the Wi-Fi layer reveals the encrypted payload underneath. That was the practical mitigation while patching happened, and it is the durable lesson: link-layer encryption is a layer, not the whole answer.

How it was fixed

Patches make clients refuse to reinstall a key that is already in use. The retransmission is still accepted and acknowledged — so the reliability behaviour the standard requires is preserved — but the counters are not reset.

It was fixed without changing the protocol, and patched and unpatched devices interoperate, which is why deployment was straightforward for devices that received updates at all.

WPA3 addresses the underlying concern differently. Its handshake, using Simultaneous Authentication of Equals, is a different construction with a formal security analysis covering this class of issue, and it also brings forward secrecy and resistance to offline cracking of a captured exchange — the progression described under WPA and TKIP.

What to take from it

Three things worth carrying beyond the specific attack.

Formal proofs cover what they model. The WPA2 handshake proof did not account for retransmission and reinstallation, and the gap between the model and the implementation requirement is where the flaw lived.

Nonce reuse is catastrophic in any counter-mode encryption, which is a general cryptographic principle and appears well beyond wireless.

Client-side vulnerabilities patch slowly. A flaw requiring updates on every laptop, phone, printer and sensor has a long tail, and the devices that never update are the ones with the longest service lives. Planning for that — segmenting unpatchable devices, as under guest and BYOD wireless design — is more durable than assuming a patch will reach everything.

Exam angles

Know KRACK as a WPA2 protocol flaw exploiting mandatory retransmission of the four-way handshake's third message, causing key reinstallation and nonce reset, which enables keystream reuse and decryption. Know that it does not recover the network password, requires attacker proximity and an on-path position, and primarily affects clients. Identify client patching as the fix, end-to-end encryption as the mitigation, and WPA3's SAE handshake as the structural replacement.