Re-Breaking Wireless Protected Setup

Wireless Protected Setup (WPS) is a recent authentication mechanism introduced by the Wi-Fi Alliance in order to simplify the cumbersome authentication procedure specified by previous Wi-Fi standards. It reduces the authentication to a simple exchange of a token that, in the most simple configuration, is a numerical PIN. It has been shown that using this simple configuration it is possible to reveal the PIN with an on-line brute force attack . The attack can be mitigated introducing increasing delays between two consecutive authentication attempts. This paper has a double focus, the first is to describe and explain the existing attack, since documentation on this topic is scarce in scientific literature. The second is the introduction of an extension of the attack that can be successfully run even when the access point implements the suggested countermeasure.