<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">% File              : template.tex
% Version           : $Revision: 1.2 $
% Last-modified     : $Date: 2005/01/04 11:38:53 $
% Last-modifier     : FJ

\documentclass{splib}

\newcommand{\xor}{\oplus}
\begin{document}
% main environment
\begin{protocol}%
% name
{Wired Equivalent Privacy Protocol}%
% authors
{}%
% date of the first publication
{}%
% editor name
{}%
% date of submission
{}%
% date of last change, empty or = date of submission
{}

\begin{abstract}
The Wired Equivalent Privacy (WEP) protocol, described in~\cite{802.11}, is
used to protect data during wireless transmission.
\end{abstract}

\begin{core}
\begin{declarations}
\dcl{A, B}{principal}
\dcl{Kab}{symkey}
\dcl{RC4}{message, symkey -&gt; message}
\dcl{C}{message -&gt; message}

\end{declarations}

\begin{messages}
\msg{1} {A}{B}{ v, (\tuple{M,C(M)} xor RC4(v,Kab))}
\end{messages}
\end{core}


\begin{explanation}
 To encrypt the message
\code{M}, \code{A} applies the operator xor to \code{RC4(v,Kab)} and
\code{\tuple{M,C(M)}} where \code{C(M)} is the \emph{integrity checksum} of
the message \code{M} and \code{RC4} is a function modeling the RC4 algorithm
which is used to generate a \emph{keystream} (\emph{i.e.} a long sequence of
pseudo-random bytes) from the initial vector \code{v} and the secret key
\code{Kab} shared between \code{A} and \code{B}. To decrypt the received
message, \code{B} computes \code{RC4(v,Kab)} and after applying exclusive or,
he obtains \code{\tuple{M,C(M)}} and can verify that the
checksum is correct.

The properties of exclusive or are:

\begin{eqnarray*}
\code{x xor (y xor z)} &amp;=&amp; \code{(x xor y) xor z} ~~\mbox{(E1)}\\
\code{x xor y} &amp;=&amp; \code{y xor x}  ~~\mbox{(E2)}\\
\code{x xor 0} &amp;=&amp; \code{x}  ~~\mbox{(E3)}\\
\code{x xor x} &amp;=&amp; \code{0}  ~~\mbox{(E4)}
\end{eqnarray*}
\end{explanation}

%\begin{property}
%\end{property}

\begin{references}
\cite{802.11}
\end{references}



\begin{attacks}
We present below attacks given in~\cite{Borisov01} that require the following properties:
\begin{eqnarray*}
\code{C(x xor y)} &amp;=&amp; \code{C(x) xor C(Y)}~~ ~\mbox{(E5)} \\
\code{\tuple{x1,y1} xor \tuple{x2,y2}} &amp;=&amp; \code{\tuple{x1 xor x2,y1 xor y2}} ~~ ~\mbox{(E6)}
\end{eqnarray*}
According to~\cite{Borisov01}, (E5) is a general property of CRC checksum.

The first attack uses the fact that encrypting two messages \code{P1}
and \code{P2} with the same initial vector~\code{v} and with the same
key~\code{k} can reveal information. Indeed, we have the following
equalities between the ciphers
\code{C1} and \code{C2} and their associated plain text~\code{P1} and \code{P2}:

\begin{tabular}{rcll}
\code{C1 xor C2} &amp;\code{=}&amp; \code{(\tuple{P1,C(P1)} xor RC4(v,k)) xor (\tuple{P2,C(P2)} xor RC4(v,k))}&amp; \\
&amp;\code{=}&amp; \code{(\tuple{P1,C(P1)} xor \tuple{P2,C(P2)}) xor (RC4(v,k)xor RC4(v,k))}&amp; $\;\;$(E1)(E2) \\
&amp;\code{=}&amp; \tuple{P1,C(P1)} xor \tuple{P2,C(P2)} &amp; $\;\;$(E3)(E4)
\end{tabular}

This allows an intruder who knows a plain text \code{P1} and its cipher
\code{C1} to decrypt any cipher \code{C2}. Indeed, thanks to this equality,
the intruder can easily get \tuple{P2,C(P2)} and obtain the plaintext
\code{P2}.

\medskip

The second attack allows the intruder controlled modifications to a cipher text
without disrupting the checksum. Assume that the intruder has
intercepted
\code{\tuple{M,C(M)}xor RC4(v,Kab)} and knows \code{D}. He can now obtain the cipher text associated to the message \code{Mxor D} by computin
g:

\medskip

\hspace{-6mm}\begin{tabular}{rcll}
\code{(\tuple{M,C(M)} xor RC4(v,Kab)) xor \tuple{D,C(D)}} &amp;\code{=}&amp;
\code{RC4(v,Kab)xor(\tuple{M,C(M)} xor \tuple{D,C(D)})} &amp; $\;\;$ (E1)(E2)\\
&amp;\code{=}&amp;\code{RC4(v,Kab) xor \tuple{M xor D,C(M) xor C(D)}}&amp; $\;\;$ (E6)\\
&amp;\code{=}&amp;\code{RC4(v,Kab) xor \tuple{M xor D,C(M xor D)}}&amp; $\;\;$ (E5)\\
\end{tabular}


Notice that this attack can be applied without full knowledge of \code{M}. For
example, to flip the first bit of \code{M}, the attacker can set 
\code{D = 100...0}. Now, if the intruder knows the plaintext \code{M} (and its
associated cipher) he can generate the ciphertext associated to any message he wants.
\end{attacks}


\end{protocol}
\end{document}

%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
</pre></body></html>