National Cyber Warfare Foundation (NCWF)

Welcome back, aspiring cyberwarriors! In a previous article, we examined the core of WPA3 – the Simultaneous Authentication of Equals (SAE) handshake, also known as Dragonfly. This mechanism replaced WPA2’s vulnerable Pre-Shared Key (PSK) authentication and enhanced overall security. However, within a year of deployment, security researchers identified a comprehensive suite of vulnerabilities collectively known […]

The post Wi-Fi Hacking: Dragonblood Attacks against WPA3 first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

In a previous article, we examined the core of WPA3 – the Simultaneous Authentication of Equals (SAE) handshake, also known as Dragonfly. This mechanism replaced WPA2’s vulnerable Pre-Shared Key (PSK) authentication and enhanced overall security. However, within a year of deployment, security researchers identified a comprehensive suite of vulnerabilities collectively known as “Dragonblood attacks”.

In this article, I will introduce the core vulnerabilities in Dragonfly to provide a clearer understanding of the new attack vectors.

WPA3 vs WPA2 Vulnerabilities

The vulnerability profiles of WPA2 and WPA3 present fundamentally different security challenges; please refer to the table below for an overview.

Feature / Vulnerability	WPA2	WPA3
Encryption Strength	AES-CCMP 128-bit, solid but aging	AES-GCMP 128/192-bit, stronger and modernized
Key Exchange Method	4-way handshake with Pre-Shared Key (PSK), vulnerable to KRACK and replay attacks	Simultaneous Authentication of Equals (SAE), resistant to KRACK and offline dictionary attacks
Protection Against Offline Brute-Force	Weak; captured handshakes allow offline dictionary attacks on weak passwords	Strong; SAE requires interaction per guess, blocking offline attacks
Forward Secrecy	No; compromise of current keys exposes past sessions	Yes; ephemeral keys protect past sessions even if current keys leak
Individualized Data Encryption	No; shared keys mean one breach risks all traffic	Yes; each device’s traffic encrypted separately, preventing eavesdropping
Vulnerabilities to Side-Channel Attacks	Limited research; generally not a focus	Possible; timing and implementation flaws (Dragonblood) can leak info
Downgrade Attack Risk	High; no protection against forced fallback to weaker protocols	Present; transition mode allows downgrade to WPA2, enabling dictionary attacks
Management Frame Protection	Optional; many devices don’t enforce PMF, exposing to deauth/disassoc attacks	Mandatory; PMF required, improving network stability and security
IoT Device Support	Limited; often insecure due to weak passwords and lack of individualized encryption	Improved; better key management and encryption tailored for constrained devices
Implementation Complexity	Proven and widely supported; simpler but with known flaws	More complex; newer protocol with some implementation pitfalls leading to vulnerabilities
Known Exploits	KRACK, offline dictionary, replay, weak password attacks	Dragonblood (timing, downgrade), side-channel, downgrade to WPA2

Downgrade Attacks

WPA3 was supposed to be the next big leap in Wi-Fi security – stronger, smarter, and safer. But thanks to its backward compatibility with WPA2, it opens a dangerous door for attackers.

WPA3 transition mode lets an access point (AP) support both WPA3-SAE and WPA2-PSK with the same password. This sounds convenient – old devices can still connect – but it’s a double-edged sword. An attacker can set up a rogue AP that only supports WPA2 but uses the same SSID. Nearby WPA3-capable clients get tricked into connecting via WPA2 instead of WPA3.

How the Attack Plays Out

The attacker broadcasts a fake WPA2-only network with the victim’s SSID.

The client connects using WPA2.

The attacker forges the first handshake message (which is unauthenticated).

The client replies with the second handshake message (authenticated), which leaks enough info for a dictionary attack.

Another important aspect is group downgrade. WPA3’s Dragonfly handshake (SAE) negotiates which cryptographic group (elliptic curve or MODP group) to use. Unfortunately, this negotiation is not cryptographically protected. An attacker can intercept and forge “unsupported group” responses to force the client into using a weaker group, making the handshake easier to crack.

Timing-Based Password Partitioning (CVE-2019-9494)

Dragonfly, the handshake behind WPA3-SAE and EAP-pwd, relies on a hash-to-group or hash-to-curve function to map your password into a cryptographic group. But here’s the problem: the time it takes to do this isn’t always constant – it can leak information about the password itself. If you can measure how long it takes for the handshake to process, you can start whittling down the possible passwords, bit by bit.

Let’s break it down:

Variable Iterations: When using certain MODP groups (like RFC 5114’s groups 22, 23, and 24), the algorithm sometimes needs to loop multiple times, depending on the output of a Key Derivation Function (KDF). The number of loops depends on the password and the group parameters. For group 24, for example, there’s a whopping 47% chance the KDF spits out a value that forces another iteration. That means the time it takes to complete the handshake is directly tied to the password.

MAC Address Spoofing: Since the MAC addresses (identities) are part of the KDF input, an attacker can spoof different MACs, measure the response times for each, and build a profile of how many iterations are needed for each address. With enough measurements, you can statistically sort which addresses (and thus which password candidates) take longer.

Brainpool Curve Weaknesses: Even with Brainpool curves—supposedly safer—the hash-to-curve method still leaks timing info. The number of real iterations and the variance in execution time can fingerprint the password, though it takes more measurements to tease out the info.

Invalid Curve Point Attacks

WPA3’s promise of robust security through elliptic curve cryptography hits a major problem when implementations fail to properly validate elliptic curve points. The SAE (Simultaneous Authentication of Equals) protocol relies on both parties exchanging these points, but skipping or inadequately performing validation lets attackers slip in malicious “twist” points—points that lie not on the intended curve but on its mathematical “twist.” When devices operate on these invalid points without checking, subtle error patterns and timing differences leak critical information about the secret password element.

Attackers can craft invalid points to probe implementations, revealing weak validation and enabling password recovery. Small subgroup attacks compound the problem by pushing operations into smaller, mathematically reduced groups where brute force becomes feasible.

Resource Exhaustion and Denial of Service

WPA3’s Simultaneous Authentication of Equals (SAE) handshake relies heavily on elliptic curve cryptographic operations, which are computationally expensive. Attackers exploit this by flooding access points with a barrage of authentication requests, each forcing the AP to perform these costly elliptic curve calculations. This relentless assault can quickly overwhelm the CPU, leading to severe performance degradation or outright denial of service, preventing legitimate users from connecting.

The “hunting and pecking” process—where the protocol iteratively searches for a valid password element—is particularly resource-intensive and thus an attractive target for such DoS attacks. Some implementations worsen the problem by accumulating incomplete authentication state data in memory, eventually exhausting system resources and causing crashes or reboots.

Research has demonstrated that even low-powered attacker devices can trigger these overloads by sending as few as 70 spoofed commit frames per second, causing the target AP’s CPU to spike to 100% usage while consuming only a small fraction of the available wireless airtime. This makes the attack both efficient and devastating, highlighting a fundamental weakness in WPA3’s current design and implementation.

Summary

While WPA3 successfully addresses many of WPA2’s fundamental weaknesses, it also has some new attack vectors.

To learn more about this attack and others, attend our brand new Wi-Fi Hacking v4 training online July 22-24.