Mathy Vanhoef da Eyal Ronen) sabuwar hanyar kai hari (CVE-2019-13377) akan cibiyoyin sadarwa mara waya ta amfani da fasahar tsaro ta WPA3, wanda ke ba da damar samun bayanai game da halayen kalmar sirri da za a iya amfani da su don tantance shi a layi. Matsalar tana bayyana a sigar yanzu .
Bari mu tuna cewa a cikin Afrilu mawallafa iri ɗaya ne lahani shida a cikin WPA3, don magance wanda Wi-Fi Alliance, wanda ke haɓaka ƙa'idodi don cibiyoyin sadarwar mara waya, ya yi canje-canje ga shawarwari don tabbatar da ingantaccen aiwatarwa na WPA3, wanda ke buƙatar amfani da amintattun masu lankwasa elliptic. , maimakon masu lanƙwasa elliptik a baya P-521 da P-256.
Koyaya, bincike ya nuna cewa amfani da Brainpool yana haifar da sabon nau'in leaks na tashoshi na gefe a cikin algorithm na shawarwarin da aka yi amfani da shi a cikin WPA3. , kariya daga hasashen kalmar sirri a yanayin layi. Matsalar da aka gano ta nuna cewa ƙirƙirar aiwatar da Dragonfly da WPA3 ba tare da ɓarna bayanan ɓangarori na uku yana da matuƙar wahala ba, kuma yana nuna gazawar ƙirar haɓaka ƙa'idodi a bayan ƙofofin da aka rufe ba tare da tattaunawa da jama'a game da hanyoyin da aka tsara ba da tantancewa ta al'umma.
Lokacin amfani da lanƙwan elliptic na Brainpool, Dragonfly yana ɓoye kalmar sirri ta hanyar yin gyare-gyaren farko na kalmar sirri don ƙididdige ɗan gajeren zanta da sauri kafin yin amfani da madaidaicin lanƙwasa. Har sai an sami ɗan gajeren zanta, ayyukan da aka yi sun dogara kai tsaye ga kalmar sirrin abokin ciniki da adireshin MAC. Za a iya auna lokacin aiwatarwa (wanda ke da alaƙa da adadin yawan maimaitawa) da jinkiri tsakanin ayyuka yayin maimaitawa na farko da kuma amfani da su don tantance halayen kalmar sirri waɗanda za a iya amfani da su ta layi don haɓaka zaɓin sassan kalmar sirri a cikin tsarin tantance kalmar sirri. Don kai hari, mai amfani da ke haɗa zuwa cibiyar sadarwar mara waya dole ne ya sami damar shiga tsarin.
Bugu da ƙari, masu binciken sun gano lahani na biyu (CVE-2019-13456) da ke da alaƙa da zubar da bayanai a cikin aiwatar da yarjejeniya. , ta amfani da Dragonfly algorithm. Matsalar ta keɓance ga uwar garken FreeRADIUS RADIUS kuma, dangane da kwararar bayanai ta hanyar tashoshi na ɓangare na uku, kamar raunin farko, yana iya sauƙaƙa hasashe kalmar sirri.
Haɗe tare da ingantacciyar hanya don tace hayaniya a cikin tsarin ma'aunin latency, ma'auni 75 a kowane adireshin MAC sun isa don tantance adadin abubuwan sake kunnawa. Lokacin amfani da GPU, ana ƙididdige ƙimar albarkatun don tantance kalmar sirri ɗaya a $1. Hanyoyi don inganta tsaro na yarjejeniya don toshe matsalolin da aka gano an riga an haɗa su cikin daftarin sigogin Wi-Fi na gaba () da kuma . Abin baƙin ciki, ba zai yiwu a kawar da leaks ta hanyar tashoshi na ɓangare na uku ba tare da karya daidaituwar baya ba a cikin sigar ƙa'idar yanzu.
source: budenet.ru