<table cellspacing="0" cellpadding="0" border="0" ><tr><td valign="top" style="font: inherit;">Jouni, wpa_receive() is only for EAPOL-KEY message, not for encrypted data. isn't it? For MIC error happens in data packets, we will wait 2 times.<br>Please correct me if I'm wrong.<br><br><br>--- On <b>Wed, 11/12/08, Jouni Malinen <i><j@w1.fi></i></b> wrote:<br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; padding-left: 5px;">From: Jouni Malinen <j@w1.fi><br>Subject: Re: TKIP attack<br>To: hostap@lists.shmoo.com<br>Date: Wednesday, November 12, 2008, 7:00 AM<br><br><pre>On Tue, Nov 11, 2008 at 07:50:02PM -0800, Miles wrote:<br>> Thank your reply, but I checked and found following(version 0.4.8):<br>> if (now > hapd->michael_mic_failure + 60) {<br>> hapd->michael_mic_failures = 1;<br>> } else {<br>>
hapd->michael_mic_failures++;<br>> if (hapd->michael_mic_failures > 1)<br>> ieee80211_tkip_countermeasures_start(hapd);<br>> }<br>> <br>> It will wait until the second MIC error and then go to countermeasure.<br><br>Yes, but the PTK rekeying is handled in wpa_receive() and it is done for<br>every MIC error report.<br><br>> Even hostapd will go to countermeasure mode for every single MIC error, is<br>it too expensive to kick out all clients? How about we just rekey or deauth the<br>client who cause it.<br><br>TKIP countermeasures are required if there are two MIC failures within<br>60 seconds and that is not going to change unless the standard and<br>certification tests are changed (i.e., unlikely to happen). Likewise, I<br>don't think I would be enabling countermeasures on a single MIC
failure<br>or change the behavior to deauthenticate a client (it's not really the<br>client causing it here; it's the attacker..).<br><br>Rekeying of PTK is already done for each error report. I could consider<br>changing the code to rekey GTK, too, if the error report is for a group<br>key. I don't think that that part is handled in the current<br>implementation.<br><br>-- <br>Jouni Malinen PGP id EFC895FA<br>_______________________________________________<br>HostAP mailing list<br>HostAP@lists.shmoo.com<br>http://lists.shmoo.com/mailman/listinfo/hostap<br></pre></blockquote></td></tr></table><br>