When using statistical techniques to crack a WEP key, each byte of the key is essentially handled individually. For non-x86 CPUs, SIMD improvements are present as well. With the exception of AVX512, all other instructions are built-in Aircrack-ng, and it will automatically select the fastest available for the CPU. SSE2, AVX, AVX2, and AVX512 support is included to dramatically speed up WPA/WPA2 key processing. EAPOL packets (2 and 3) or packets (3 and 4) are considered a full handshake. However, aircrack-ng is able to work successfully with just 2 packets. For WPA handshakes, a full handshake is composed of four packets. A “four-way handshake” is required as input. It requires more packets than PTW, but on the other hand is able to recover the passphrase when PTW sometimes fail.Īdditionally, the program offers a dictionary method for determining the WEP key.įor cracking WPA/WPA2 pre-shared keys, only a dictionary method is used. The FMS/KoreK method incorporates various statistical attacks to discover the WEP key and uses these in combination with brute forcing. The other, older method is the FMS/KoreK method.

The main advantage of the PTW approach is that very few data packets are required to crack the WEP key. An important limitation is that the PTW attack currently can only crack 40 and 104 bit WEP keys. This Tutorial: Packets Supported for the PTW Attack page provides details. Please remember that not all packets can be used for the PTW method. If the key is not found, then it uses all the packets in the capture. In the first phase, aircrack-ng only uses ARP packets. The first method is via the PTW approach (Pyshkin, Tews, Weinmann). This part of the aircrack-ng suite determines the WEP key using two fundamental methods. Aircrack-ng is an 802.11 WEP and WPA/WPA2-PSK key cracking program.Īircrack-ng can recover the WEP key once enough encrypted packets have been captured with airodump-ng.

How to use aircrack