PaperlayerView exact revision on arXiv

Source-linked AI summary

Fast and Secure Simultaneous Authentication of Equals for WPA3

João Ferreira, André Zúquete, Hélder Gomes

arXiv:2609.31519v1cs.CRcs.NI

TL;DR

SAE’s costly PE derivation can expose APs to CPU-exhaustion attacks. This architecture shifts iterative discovery to the Supplicant and adds stateless ticket resumption. It reports lower initial and re-authentication latency, while ticket use trades away forward secrecy.

Abstract

from arXiv · show

The Simultaneous Authentication of Equals (SAE) protocol, introduced in WPA3, provides robust protection against offline dictionary attacks against a network Pre-Shared Key (PSK) and also protection of session keys from other people knowing that PSK. However, its high computational cost for the Password Element (PE) derivation makes Access Points (APs) vulnerable to CPU exhaustion Denial-of-Service (DoS) attacks. This paper proposes a resilient architectural modification to SAE. First, we introduce an asymmetric resource cost model that offloads the iterative discovery of cryptographic elements to the client, allowing the AP to maintain a fixed computational load during the handshake. To further mitigate brute-force attempts, we implement a mechanism based on a slow-path key derivation (with variable cost key derivation functions, such as PBKDF2 or Argon2), incorporating a deliberate processing delay on the supplicant. Finally, we introduce a ticket-based mechanism to facilitate efficient re-authentication for known devices, bypassing expensive exchanges while preserving system availability under adversarial conditions. Experimental results demonstrate that this architecture significantly mitigates DoS risks without compromising legitimate network access.

I. INTRODUCTION

SAE protects the PSK through an iterative Password Element search, but that work burdens Access Points and exposes them to forged-commit CPU exhaustion. The proposed approach shifts the search to the Supplicant while keeping AP verification lightweight.

I. INTRODUCTION

  • Forged authentication commits can force an AP to repeat costly elliptic-curve operations and memory allocations, exhausting CPU and blocking legitimate connections.The Hunting-and-Pecking procedure derives the Password Element (PE) used in SAE.Source: §I · p. 1
  • The proposed handshake moves iterative PE discovery to the Supplicant, leaving the AP to verify supplied values in a single step.A deliberately costly client-side derivation adds a substantial processing delay while the AP remains resilient to flood-based CPU exhaustion.Source: §I · p. 1

A. The SAE Protocol and Dragonfly Handshake

  • SAE derives a session-bound elliptic-curve PE from the PSK, both peers’ MAC addresses, and a counter through probabilistic Hunting-and-Pecking.The standard AP search must perform at least 40 iterations to resist timing attacks.Source: A. The SAE Protocol and Dragonfly… · p. 1

B. SAE Messages and Computations

  • The Supplicant and AP exchange commit values s and E, then confirm a fresh shared PMK that others who know the PSK cannot guess.Confirmation uses PMK-keyed HMAC values over the exchanged s and E values.Source: B. SAE Messages and Computations · pp. 1–2

C. Resource Exhaustion Vulnerabilities

The standard SAE handshake leaves APs vulnerable to resource exhaustion, while existing reconnection approaches bring state, memory, or privacy trade-offs. The proposed stateless ticket approach places session state in an encrypted client-held envelope.

C. Resource Exhaustion Vulnerabilities

  • Forged commit floods can force expensive PE searches even after anti-clogging checks, potentially driving AP CPU to 100% and preventing legitimate connections.Anti-clogging verifies MAC reachability but does not prevent a motivated attacker from completing the token exchange.Source: C. Resource Exhaustion Vulnerabilities · p. 2

D. Related Work and Session Resumption Mechanisms

  • PMK caching and OKC require AP key databases that can fill with stale state; PMKID exposure also supports offline PSK guessing and impedes MAC randomization.These mechanisms store pairwise keys from previous sessions.Source: D. Related Work and Session Resumption… · p. 2
  • FILS reduces authentication frames but retains the computational burden of initial SAE Hunting-and-Pecking on resource-constrained devices.The proposed approach instead uses stateless ticket-based resumption, with encrypted session state held by the Supplicant.Source: D. Related Work and Session Resumption… · p. 2
  • Stateless ticket resumption lets APs verify returning devices with minimal CPU and memory overhead while allowing consecutive authentications to use new MAC addresses.A paired-token alternative reduces memory consumption but introduces token-management and verification-cost challenges under high load.Source: D. Related Work and Session Resumption… · p. 2

III. PROPOSED ALTERNATIVE: RESILIENT SAE WITH STATELESS RESUMPTION

The architecture splits authentication into an initial exchange and a stateless fast resumption path. For initial authentication, the Supplicant performs iterative PE discovery and the AP verifies the supplied values with fixed, lower per-request CPU cost.

A. Architecture Overview

  • The architecture divides authentication into Resource Intensive Initial Exchange (RIIE) and Stateless Fast Track Resumption (SFTR) to rebalance AP and Supplicant computation.SFTR is the stateless resumption path.Source: A. Architecture Overview · p. 2
  • In RIIE, the Supplicant performs iterative PE discovery; after successful confirmation, the AP issues a protected ticket that lets later SFTR connections bypass SAE commit-confirm processing.The AP decrypts the ticket to recover a fresh session key in a single symmetric-decryption step.Source: A. Architecture Overview · p. 2, B. RIIE: Fast PE Derivation and… · p. 2

B. RIIE: Fast PE Derivation and Verification in APs

  • For each initial request, the AP derives and verifies PE in one step rather than iterating, keeping CPU use constant and lower regardless of the Supplicant’s search iterations.The Supplicant increments p and recomputes s when a PE candidate is invalid; the AP uses the supplied s and its local hashed PSK for verification.Source: B. RIIE: Fast PE Derivation and… · p. 3

C. Brute Force PSK Discovery Mitigation via Slow Path Derivation

Single-step AP derivation makes offline PSK guesses easier to test, so the paper uses a deliberately slow password-hash derivation to restore a computational bottleneck for attackers.

C. Brute Force PSK Discovery Mitigation via Slow Path Derivation

  • The AP’s single-step SAE counter calculation also gives eavesdroppers a direct way to verify PSK guesses without the original Dragonfly loop.An attacker can test candidate PSKs by generating the observed s value.Source: C. Brute Force PSK Discovery… · p. 3
  • A slow-path password hash uses PBKDF2 or Argon2, with iterations and a salt from AP Beacon frames, to make each offline PSK test costly while keeping AP verification efficient.The passage says this makes offline dictionary attacks impractical by imposing a significant cost per candidate PSK.Source: C. Brute Force PSK Discovery… · p. 3

D. SFTR: Stateless Session Tickets and Key Management

SFTR uses stateless session tickets so returning Supplicants can avoid repeating the expensive initial SAE derivation. The AP protects tickets containing future PMKs and can validate and renew them without keeping per-ticket records.

D. SFTR: Stateless Session Tickets and Key Management

  • A ticket lets a returning Supplicant redeem a future PMK instead of running SAE again, while the AP avoids maintaining records of issued tickets.After successful ticket authentication, the AP can issue another ticket, protecting its future PMK with the redeemed ticket’s PMK.Source: 1) Ticket Encryption and Integrity · pp. 3–4

1) Ticket Encryption and Integrity:

2) Key Recovery and Derivation:

Ticket reconnection uses a modified SAE Commit exchange to validate the ticket and recover its PMK. Accepted tickets proceed through SAE Confirm and the ordinary 4-Way Handshake; the system was implemented on hostapd v2.10.

2) Key Recovery and Derivation:

  • A ticket reconnection uses a modified SAE Commit with null s and the ticket in place of E; the AP responds with s = 0 on acceptance or s = 1 and terminates the handshake otherwise.The passage distinguishes s = 0 from normal SAE, where s must be higher than 1.Source: 2) Key Recovery and Derivation · p. 4
  • After ticket acceptance, both parties calculate SAE Confirm messages with the ticket’s PMK, then complete the ordinary 4-Way Handshake with that PMK.The 4-Way Handshake finalizes mutual authentication and key distribution.Source: 2) Key Recovery and Derivation · p. 4

IV. IMPLEMENTATION

  • The authors implemented the complete session management system using the hostapd v2.10 code base.The modified source code is publicly available.Source: §IV · p. 4

A. Access Point Signaling via Information Elements

A vendor-specific Information Element advertises the modified SAE protocol and the PBKDF2 inputs. The hostapd state machine routes ticket-bearing Commit frames to validation and PMK recovery, and the security analysis identifies ticket robustness and AP verification efficiency as dependencies.

A. Access Point Signaling via Information Elements

  • A vendor-specific IE in Beacon and Probe Reply frames signals modified SAE and ticket resumption, and carries the salt and PBKDF2 iteration count used to derive pwd hash.The example Beacon frame shows an iteration count of 4096.Source: A. Access Point Signaling via… · p. 4, Figure 2 · p. 4

B. State Machine and Message Modifications

  • The modified hostapd state machine intercepts SAE Commit frames and sends ticket-indicated frames directly to ticket validation and PMK recovery.Tickets are distributed as an extra field in the AP’s SAE Confirm frame.Source: B. State Machine and Message… · p. 4

V. SECURITY ANALYSIS

  • The architecture’s security depends on the session-ticket mechanism being robust and the AP verification path being efficient.Source: §V · p. 4

A. Resilience Against DoS attacks

The security analysis describes lightweight AP verification alongside protections for ticket confidentiality, integrity, replay, and offline brute-force resistance. It also identifies a forward-secrecy trade-off for ticket use and an alternative for Supplicants that require forward secrecy.

A. Resilience Against DoS attacks

  • The AP avoids heavy PE derivation by using a cached pwd hash and lightweight HMAC for ticket verification, reducing the computation it performs on authentication attempts.The passage identifies protecting AP CPU from exhaustion as the primary security objective.Source: A. Resilience Against DoS attacks · p. 4

B. Ticket Integrity, Confidentiality and Replay Protection

C. Resistance to Offline Brute-Force Attacks

D. Forward Secrecy

  • Ticket use loses forward secrecy, while a Supplicant that requires it can derive pwd hash once and reuse its previous s value while changing p and m.This requires recalculating E, but not s, which the passage identifies as the element found by trial and error.Source: D. Forward Secrecy · p. 5

E. Protection Against Parameter Downgrade Attacks

Supplicants should reject password-derivation parameters below a local minimum to prevent a rogue AP from weakening the computational barrier. The evaluation uses a controlled virtualized testbed and a prototype configured with a 10-iteration PBKDF2 baseline for functional validation.

E. Protection Against Parameter Downgrade Attacks

  • A rogue AP could send a low iteration count to weaken PE derivation and make offline dictionary attacks easier; Supplicants should enforce a local minimum threshold.The passage gives 108 as an example threshold.Source: E. Protection Against Parameter… · p. 5

VI. PERFORMANCE EVALUATION

  • The evaluation compares authentication latency and computational overhead using a virtualized testbed designed to isolate cryptographic costs from wireless interference and jitter.The virtual bridge prioritizes processing-latency measurement over transmission time.Source: §VI · p. 5, A. Experimental Setup · p. 5

A. Experimental Setup

  • The controlled testbed used an Intel Core i9-13900HX host with 32 GB of RAM and separate virtual machines for the AP and Supplicant.The prototype modified hostapd and wpa_supplicant v2.10 and linked them against OpenSSL for ECC and PBKDF2.Source: A. Experimental Setup · p. 5
  • The initial slow-path PBKDF2 configuration used 10 iterations for functional validation and was designed to scale to higher counts for specific security requirements.This prototype baseline is distinct from the higher iteration threshold suggested for downgrade protection.Source: A. Experimental Setup · p. 5

B. Authentication Latency Analysis

The evaluation reports much lower processing time for proposed initial authentication than standard SAE, with an even larger latency reduction for ticket-based re-authentication. Latency was measured from SAE exchange initiation through PMK derivation.

B. Authentication Latency Analysis

1) Initial Authentication Performance:

  • 2284 µs (σ = 521.8) for standard SAE versus 72.5 µs (σ = 11.0) for proposed initial authentication; mean processing time fell about 96.8%.The proposed strategy also had lower temporal variance than the iterative standard process.Source: 1) Initial Authentication Performance · p. 5, Table I · p. 5

2) Re-authentication: The Efficiency of Stateless Tickets:

  • Approximately 99% lower authentication latency was observed for ticket re-authentication, which bypasses PE derivation and requires only one symmetric decryption at the AP.Table I compares AP computational performance for the standard and proposed models (N = 100).Source: 2) Re-authentication: The Efficiency… · pp. 5–6, Table I · p. 5

C. Final Remarks

The paper reports a more stable AP resource profile and argues that slow-path derivation preserves offline-dictionary-attack barriers while tickets speed later authentications. It identifies deployment on commercial routers, compatibility, and forward secrecy as future-work areas.

C. Final Remarks

  • The slow-path derivation maintains offline-dictionary-attack barriers, while stateless tickets offer a faster option for subsequent authentication and remove elliptic-curve work during re-authentication.The paper concludes that this architecture improves authentication efficiency and scalability for resource-constrained network infrastructures.Source: C. Final Remarks · p. 6

VII. CONCLUSIONS AND FUTURE WORK

  • The conclusion presents deterministic slow-path derivation from the network passphrase to broadcast s values as preserving resistance to offline dictionary attacks.It frames the redesign as shifting the heavy PE-finding workload away from APs.Source: §VII · p. 6
  • The listed contributions include stabilizing AP CPU use for low-power IoT gateways, faster ticket-based reconnection, and stateless handling of concurrent authentication attempts.Source: §VII · p. 6
  • Beacon IE parameters let network administrators impose an arbitrary burden on passphrase-guessing attacks without changing standards or implementations.Source: §VII · p. 6
  • Future work includes testing the modified implementation on commercial embedded routers, investigating compatibility with standard WPA3 Supplicants, and designing tickets that provide fast PMK installation while ensuring forward secrecy.Source: §VII · p. 6
Loading 2609.31519v1…