Dragonblood.

Dragonblood was disclosed in April 2019 by Mathy Vanhoef (KU Leuven) and Eyal Ronen (Tel Aviv University / KU Leuven), the same researcher behind KRACK. It targets the Simultaneous Authentication of Equals (SAE) handshake — also called Dragonfly — used by WPA3-Personal, which was meant to make Wi-Fi passwords immune to offline dictionary attacks.

The core problem is the "hunt-and-peck" password-element (PWE) derivation. Its number of loop iterations and cache-access pattern depend on the password, so a nearby attacker who forces repeated handshakes can measure timing (CVE-2019-9494) or observe cache use (CVE-2019-9495) and leak enough information to run an offline password-partitioning attack that recovers the pre-shared key. Related flaws include a reflection/denial-of-service issue and missing state validation in the SAE confirm exchange (CVE-2019-9496). Separately, because most access points run WPA3-Transition mode, an attacker can spin up a rogue AP that only offers WPA2 and force a downgrade, then capture a classic PMKID for offline cracking — defeating WPA3 entirely.

The Wi-Fi Alliance and hostapd/wpa_supplicant maintainers responded by mandating the constant-time Hash-to-Element (H2E) method for PWE derivation, which removes the password-dependent branching. A follow-up study later showed even patched Brainpool-curve implementations could still leak timing, underscoring that side-channel-free crypto is hard. Defences: require H2E, disable transition mode where possible, patch client and AP firmware, and use long high-entropy passphrases.

flowchart TD
  A[Attacker near WPA3 network] --> B{Attack path}
  B -->|Side-channel| C[Force repeated SAE handshakes]
  C --> D[Measure timing / cache of<br/>hunt-and-peck PWE derivation]
  D --> E[Offline password-partitioning]
  B -->|Downgrade| F[Rogue AP offers WPA2 only]
  F --> G[Client falls back<br/>WPA3-Transition mode]
  G --> H[Capture PMKID]
  E --> I[Recover Wi-Fi passphrase]
  H --> I
  I --> J[Fix: Hash-to-Element H2E,<br/>disable transition mode, patch firmware]