Security analysis of michael: the IEEE 802.11i message integrity code

Authors:
Jianyong Huang;Jennifer Seberry;Willy Susilo;Martin Bunder
Affiliations:
University of Wollongong, NSW, Australia;University of Wollongong, NSW, Australia;University of Wollongong, NSW, Australia;University of Wollongong, NSW, Australia
Venue:
EUC'05 Proceedings of the 2005 international conference on Embedded and Ubiquitous Computing
Year:
2005

Citing 3
Cited 4

Intercepting mobile communications: the insecurity of 802.11

Proceedings of the 7th annual international conference on Mobile computing and networking
Weaknesses in the Key Scheduling Algorithm of RC4

SAC '01 Revised Papers from the 8th Annual International Workshop on Selected Areas in Cryptography
A note on the fragility of the "Michael" message integrity code

IEEE Transactions on Wireless Communications

Personal Health Record Systems and Their Security Protection

Journal of Medical Systems
Securing personal health information access in mobile healthcare environment through short signature schemes

International Journal of Mobile Communications
An RFID secure authentication mechanism in WLAN

Computer Communications
Practical verification of WPA-TKIP vulnerabilities

Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security

Quantified Score

Hi-index	0.00

Visualization

Abstract

The latest IEEE 802.11i uses a keyed hash function, called Michael, as the message integrity code. This paper describes some properties and weaknesses of Michael. We provide a necessary and sufficient condition for finding collisions of Michael. Our observation reveals that the collision status of Michael only depends on the second last block message and the output of the block function in the third last round. We show that Michael is not collision-free by providing a method to find collisions of this keyed hash function. Moreover, we develop a method to find fixed points of Michael. If the output of the block function in any round is equal to any of these fixed points, a packet forgery attack could be mounted against Michael. Since the Michael value is encrypted by RC4, the proposed packet forgery attack does not endanger the security of the whole TKIP system.