radextt-7----Page:3
1  2  3  4  5  6 

Attack Methodology
Adversary captures request and response authenticators
Mounts brute-force/dictionary attack against secret
Adversary uses secret to:
Forge Access-Accept frames
Decrypt MPPE for EAP keys
Response Auth = MD5(code + id + len + request auth + attributes + secret)
PPT Version