Dragonblood: Attacking the Dragonfly Handshake of WPA3

## Overview

Maddie van Hoff (NYU, postdoctoral researcher) and Mathy Vanhoef presented cryptographic attacks on the Dragonfly handshake, the authentication protocol newly adopted by WPA3 wireless standard (and also used in EAP-PWD for enterprise Wi-Fi). Dragonfly is a password-authenticated key exchange (PAKE) designed to address WPA2 vulnerabilities. Motivation: WPA2 permitted offline dictionary attacks—attacker could passively capture handshake, then brute-force password offline at leisure. Dragonfly promised to prevent this: no passive dictionary attacks, no active dictionary attacks without online interaction, forward secrecy (capturing encrypted traffic today and learning password tomorrow cannot decrypt old traffic), mutual authentication (client proves password knowledge, access point proves password knowledge). Research contribution: researchers discovered multiple side-channel vulnerabilities in Dragonfly password-to-group-element conversion algorithm. Most critical: timing side-channel leaks password-dependent information (iteration count) enabling practical dictionary attacks. Additional vulnerabilities: invalid-curve attacks on elliptic-curve implementations, timing attacks on group membership testing, potential for bruteforce password recovery. Historical context: IETF and CFRG mailing lists warned about timing attack risk when Dragonfly was proposed in 2010; protocol designers dismissed concerns as "not practical" and proceeded with vulnerable algorithm into WPA3 specification.

## Dragonfly Protocol Architecture and Password Conversion

**Password-Authenticated Key Exchange (PAKE) Design**: Dragonfly handshake operates in two phases: (1) Commit phase—both peers negotiate ephemeral session key using password-derived group element and cryptographic operations; (2) Confirm phase—peers exchange authentication proofs confirming both possess same password and session key. Mutual authentication requirement: client must prove password knowledge to access point; access point must prove password knowledge to client (preventing rogue access point attacks). Forward secrecy property: session key derived from ephemeral values and password; even if password compromised later, capturing encrypted traffic today and learning password tomorrow cannot decrypt old traffic (traffic encrypted with different ephemeral components). Key challenge: passwords are typically ASCII strings (low entropy, humans); cryptographic operations require membership in finite mathematical group (large prime field or elliptic curve). Solution: password conversion algorithm transforms ASCII password into valid group member using deterministic process.

**Vulnerable Password-to-Group-Element Algorithm**: Algorithm converts password string to group element via: (1) Concatenate password with MAC addresses (client MAC, AP MAC) as salt/context; (2) Hash concatenated string with counter starting at zero; (3) Interpret hash output as large number; (4) Test if number is less than group prime; (5) If yes, apply cryptographic transformation to convert to valid group member; (6) If no (hash output exceeds prime), increment counter, rehash with new counter, repeat from step 3 until success. This iteration count is password-dependent and publicly observable: for password "password123" might require 2 iterations; for password "qwerty" might require 5 iterations. Theoretical rationale: different passwords have different hash distributions, so iteration count distribution differs. Practical vulnerability: iteration count is discoverable via timing attack—attacker measures how long access point takes to respond to Dragonfly commit message, derives approximate iteration count, uses this information in dictionary attack.

## Timing Side-Channel Attack and Password Recovery

**Side-Channel Mechanics**: Access point processes Dragonfly handshake by: (1) receiving commit message from client; (2) executing password-to-group-element algorithm (which includes loop with counter iterations); (3) performing cryptographic operations; (4) sending confirm message. Total response time includes iteration loop time—each additional iteration adds ~microseconds. Attacker can measure response time variation by: timing multiple connection attempts to same access point with same password, collecting response time samples, computing average or distribution of iteration counts. Iteration count correlates with password: iterate through dictionary of candidate passwords, compute iteration count for each candidate (offline), compare offline counts to observed on-access-point, identify password candidate matching observed timing. Classical side-channel attack principle: information non-correlated with security parameter (password) still leaks through timing variations, enabling inference of security parameter.

**Practical Attack Scenario**: Attacker positioned near target WPA3 access point performs: (1) Multiple handshake initiation attempts (passive or active connect attempts); (2) Timing measurements of responses; (3) Derive observed iteration count distribution (e.g., "access point consistently takes 2 iterations"); (4) Offline dictionary generation—for each candidate password in dictionary, compute hash(password + known MACs) and iteration count to successful group element; (5) Dictionary filtering—discard candidates not matching observed iteration count; (6) Remaining candidates subject to online password guessing or further analysis. Effectiveness depends on dictionary size and iteration count precision; weak passwords (low entropy) quickly narrowed; strong random passwords still vulnerable if unique iteration counts distinguishable from timing noise. Prevention: constant-time password conversion (implement loop with maximum expected iterations, dummy iterations if needed to mask actual iteration count), masking timing variations (add random delay proportional to iteration count), or algorithm redesign avoiding counter-dependent iterations altogether.