ALT-22 · Paper · 23 Oct 2026
KRACK: re-installing a key that should be used once
The WPA2 handshake, formally proven secure, could be made to reuse its key and nonce. Mathy Vanhoef's 2017 attack — and the gap between a proof and a protocol.
- 2004WPA2 standardised; its four-way handshake is later formally proven secure.
- 16 Oct 2017KRACK published; coordinated patches across operating systems and devices.
- 2018WPA3 is announced, with a new handshake.
How it worked
The proofs covered the handshake's messages, not what an implementation does when it sees one again. Retransmitting message three made clients re-install the key and reset counters — and stream encryption with a reused nonce leaks plaintext.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- A security proof covers a model; attacks live in the gap between model and implementation.
- State machines deserve as much testing as cryptography.
- Never rely on the network layer alone: use TLS on top of Wi-Fi.
What it means for you
- Patch clients as well as access points — clients were the main target.
- Use end-to-end encryption for anything sensitive regardless of the network.
- Prefer WPA3 where devices support it.
Sources
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-22 — KRACK: re-installing a key that should be used once. 23 Oct 2026. altumptic.com/research/krack-2017