Thread: Need help on WPA-PSK

Hi there all

Can anyone help me in getting some real good stuff on WPA-PSK security protocol and methods of how to break it?

WPA uses 802.1x and Extensible Authentication Protocol (EAP) as the basis of its authentication mechanism. Authentication has a user provide some form of evidence ("credentials") that they should be allowed access to a network and checks that evidence against a database of valid users. Anyone who has ever logged into a network has gone through an Authentication process.
The database and checking parts of the Authentication process mentioned above are usually done by a special server - typically RADIUS - in large "enterprise" networks. But since WPA was intended to also be used by all WLAN owners, it was also given a simpler mode that doesn't require any fancy equipment.
This mode - called Pre-Shared Key (WPA-PSK) - only requires a single password entered into each WLAN node (Access Points, Wireless Routers, client adapters, bridges). As long as the passwords match, a client will be granted access to a WLAN. Figure 1 illustrates the process.

Figure 1: WPA - PSK Authentication
(Diagram from Wi-Fi Alliance Networld+Interop 2003 Media Presentation
Used by permission)

Encryption
Although WPA's predecessor - WEP - didn't have an Authentication mechanism at all, WEP's main problems came from the cryptographic weakness of its encryption mechanism. WEP's key problem is that the keys for different data packets are too similar.
Took this from here:User Authentication : Wi-Fi Protected Access (WPA) NeedToKnow - Part II read further if you want to know more.


As far as cracking goes, it isnt as straightforward to crack wpa as it is wep. If the user is careful enough, wpa can be made almost uncrackable. To crack wpa, you need a list of passphrases that might contain the password. If the password is in this list, a type of "brute force" will get you the key. Such password files are easy to find on the web, im sure youll find one if you need it:001_tongue::001_tongue:. Though i think is nearly impossible to crack wpa, unless the password setter is a complete jackass. If you still want to give it a try, try a distro of linux called Backtrack. Its meant for wireless penetration testing, and should contain all tools you require like kismet, aircrack etc.

Google "remote exploit" or backtrack3