Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-16 Thread Johannes Berg
On Tue, 2017-05-16 at 15:57 -0400, Michael Skeffington wrote: > Johannes, > > Thank you for that.  I need to make a quick hack to send an invalid > MIC packet from another device to test the countermeasures.  Should I > submit a new patch with this change when I've completed testing or > are you

Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-16 Thread Michael Skeffington
Johannes, Thank you for that. I need to make a quick hack to send an invalid MIC packet from another device to test the countermeasures. Should I submit a new patch with this change when I've completed testing or are you already prepared to do so? Michael On Fri, May 12, 2017 at 4:52 AM,

Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-12 Thread Johannes Berg
On Thu, 2017-05-11 at 16:22 -0400, Michael Skeffington wrote: > I am using an rt5350 SoC using the rt2x00 driver.  We were doing > WiFi-alliance certification testing on our device and the it wasn't > issuing countermeasures appropriately. > > Your assumption is correct.  I had overlooked that

Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-11 Thread Michael Skeffington
I am using an rt5350 SoC using the rt2x00 driver. We were doing WiFi-alliance certification testing on our device and the it wasn't issuing countermeasures appropriately. Your assumption is correct. I had overlooked that devices using this driver have hardware decoding and the driver sets

Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-10 Thread Jouni Malinen
On Tue, May 09, 2017 at 02:16:31PM -0400, Michael Skeffington wrote: > In order to allow wpa_supplicant to correctly identify a perceived WPA TKIP > key > recovery attack the michael MIC must be checked before the packet decode is > attempted. A packet with an invalid MIC will always fail a

Re: [PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-10 Thread Johannes Berg
On Tue, 2017-05-09 at 14:16 -0400, Michael Skeffington wrote: > In order to allow wpa_supplicant to correctly identify a perceived > WPA TKIP key > recovery attack the michael MIC must be checked before the packet > decode is > attempted.  A packet with an invalid MIC will always fail a decrypt >

[PATCH] mac80211: Validate michael MIC before attempting packet decode.

2017-05-09 Thread Michael Skeffington
In order to allow wpa_supplicant to correctly identify a perceived WPA TKIP key recovery attack the michael MIC must be checked before the packet decode is attempted. A packet with an invalid MIC will always fail a decrypt check which previously was being checked first. Therefore the MIC failure