Security of IEEE 802.11 considering Power and EM Side-Channel Information

This paper introduces the side-channel perspective on wireless security. We assume an attacker is able to measure the power consumption or the electromagnetic emanation of cryptographic operations performed at the access point or at the station. Under this assumption, we review standards for wireless security like WEP as defined in IEEE 802.11b, and TKIP as defined in IEEE 802.11i. We furthermore show how to apply a template attack at the core cipher of WEP and TKIP: RC4. Our attack can be used to recover the symmetric session key of an IEEE 802.11i compliant network.