# Key Reinstallation Attacks: Breaking WPA2 by forcing nonce reuse

Forcing retransmission of 4-way handshake message 3 makes WPA2 clients reinstall the PTK, resetting the transmit nonce and enabling keystream reuse to decrypt traffic.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: vanhoefm
- Disclosed: 2017-11-03
- CVE: CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088
- Write-up quality: 9/10
- Original: https://hackerone.com/reports/286740
- Library page: https://bugbountylibrary.com/r/h1%3A286740
- Tags: area:devices domain:network impact:data-leak kind:bounty platform:hackerone sev:medium tech:android tech:linux technique:chained technique:race-window vuln:crypto

**Target:** WPA2 4-way handshake / EAPOL-Key message 3 retransmission on Wi-Fi clients
**Root cause:** Clients reinstall an already-installed PTK upon receiving a retransmitted handshake message 3, resetting the transmit nonce counter to zero instead of rejecting the replay.
**Steps:**
1. Clone the AP on a different channel (real AP channel 6, clone on channel 1) and use Channel Switch Announcements to force victims onto the clone.
2. Forward handshake messages 1-3 between client and AP; client installs PTK after message 3.
3. Block message 4 so the AP retransmits message 3.
4. Client responds with message 4 encrypted using nonce value 1, then reinstalls the PTK, resetting the transmit nonce to zero.
5. Client's next data frame reuses nonce value 1; derive keystream from the known encrypted message 4 and decrypt parts of the data frame.
6. Use predictable packets (ARP, DHCP, HTML) for additional known plaintext/keystream to decrypt larger packets.
**How found:** Observation that retransmitted handshake message 3 causes clients to reinstall the session key, resetting the nonce counter and enabling nonce reuse.
**Exploitation:** Channel-based MITM with a cloned AP and Channel Switch Announcements forces the victim onto the attacker's channel; the attacker forwards handshake messages 1-3, drops message 4 to trigger retransmission of message 3, causing PTK reinstallation and nonce reset. Known keystream from the encrypted retransmitted message 4 plus predictable plaintext is used to decrypt victim traffic.
**Escalation:** Additional known plaintext from predictable packets (ARP, DHCP, HTML) extends decryption to more and larger packets.
**Insight:** Handshake retransmissions that trigger state reinstallation (key/nonce reset) are a reusable bug pattern: look for protocols where a replayed setup message reinitializes counters rather than being rejected.