I just read a recent ACM paper: A key Recovery Attack on the 802.11b Wired
Equivalent Privacy Protocol.
It presents 4 improvement on recovering WEP key. the author acclaims that it
can reduce pkts needed for 128-bit key from 6million to about 1million. Those
four improvements are:
1. Test all IVs i/o only weak IVs. Which is (S[1]>|CurrentKeyGuess|+1 and
S[1]+S[S[1]]=|CurrentKeyGuess|+1
2. testing if the WEP checksum on a decrypted packet turned out correctly (I
don't quite understand this part).
