There has been some disinformation in the news about the “flaws” of TKIP:įor now, TKIP is reasonably secure but it is also living on borrowed time since it still relies on the same RC4 algorithm that WEP relied on.Īctually, TKIP (WPA1) is not vulnerable: for each packet, the 48-bit IV is mixed with the 128-bit pairwise temporal key to create a 104-bit RC4 key, so there's no statistical correlation at all. How can I know what is the key length ?ĭiscard the first 256 bytes of RC4's output. Aircrack-ng defaults to the PTW method and you must manually specify the Korek method in order to use it.

Additionally, PTW only works properly with selected packet types. Keep in mind that it can take 100K packets or more even using the PTW method. PTW is limited to 40 and 104 bit keys lengths. Using this technique, 40-bit WEP (64 bit key) can be cracked with as few as 20,000 data packets and 104-bit WEP (128 bit key) with 40,000 data packets. With the introduction of the PTW technique in aircrack-ng 0.9 and above, the number of data packets required to crack WEP is dramatically lowered.

The figures above are based on using the Korek method. Then if the key is not found, restart aircrack-ng (without the -n option) to crack 104-bit WEP. Thus, it is recommended to run aircrack-ng twice: when you have 250,000 IVs, start aircrack-ng with “-n 64” to crack 40-bit WEP.

There is no way to know the WEP key length: this information is kept hidden and never announced, either in management or data packets as a consequence, airodump-ng can not report the WEP key length. Usually, 40-bit WEP (64 bit key) can be cracked with 300,000 IVs, and 104-bit WEP (128 bit key) can be cracked with 1,500,000 IVs if you're out of luck you may need two million IVs, or more. The number of required IVs depends on the WEP key length, and it also depends on your luck.

Wireshark usb wifi adapter