a greatly reduced key space that is also easily guessed.) the remarkable means by which British and American A very simple brute force recitation of all possible pass- researchers cracked the German Enigma code during words is then possible, given that one can automate the World War II, attacks on cryptographic systems are rarely recognition of a successful decryption. Because certain frontal but instead exploit weaknesses in the system and types of packets (standard handshakes for IPs) are present implementation. WEP has a number of weaknesses in almost any data stream, the latter is straightforward. and limitations, some of which were quickly apparent Because IVs can be reused, if there isn't enough traffic and others more subtle and only revealed after significant on a network to crack it, an attacker can always introduce work by outside researchers. more packets once he or she has acquired a few cipher The first weakness is in the definition of the IV. The IV streams, thus generating additional traffic in response. is necessarily sent in the clear because it is needed to Certain attacks are fixed or rendered much less effec- decrypt the message content. As we noted above, to get tive by simply increasing the length of the shared key and decent security out of a random-number-generator the IV. Many vendors have implemented WEP variants scheme, it is necessary to avoid reusing the seed value, with longer keys, though these are not specified in the because this will generate a reused cipher stream. standard and thus interoperability is questionable. For ex- However, the IV space is only 24 bits. Furthermore, ample, the larger space for keys, combined with improved there is no requirement in the specification about how hashing algorithms, renders the brute force password the IV is to be treated between successive packets; any guessing attack ineffective on 128-bit WEP key systems. IV value may be used and must be accepted by the re- The widely publicized "cracking" of the WEP algo- ceiving station. Many implement