A Time-Memory Trade-Off Attack on WPA3's SAE-PK

Abstract

To increase the security of Wi-Fi hotspots, the Wi-Fi Alliance released the SAE-PK (Simultaneous Authentication of Equals - Public Key) protocol in December 2020. In this protocol, the password of the network is derived from the public key and the name of the network. The idea is that an adversary cannot, within practical time, generate their own private and corresponding public key that leads to the same password. This prevents an adversary from setting up a rogue Wi-Fi network with the same name and password because they do not have a private and public key that results in the given password.

In this paper, we analyze the impact of time-memory trade-off attacks on the security of the SAE-PK protocol. By utilizing distinguished points to construct precomputed tables, we estimate that the amortized cost of attacks can be significantly reused when the name of the Wi-Fi network, called the SSID (Service Sets Identifier), is reused. For instance, we estimate that when an adversary is targeting an SSID used by a large number of networks, the amortized computational costs of attacking the weakest allowed SAE-PK configuration is lowered from 48 CPU years to roughly two weeks. Finally, we also demonstrate how to construct SAE-PK password collisions, where two networks with different SSIDs end up using the same password. Such a password collision enables the creation of a single precomputed table that can attack multiple SSIDs.