george0papasotiriou/cve-2026-11117-wpa2-4-way-handshake-reinstallation-krack-sim-Python simulation of CVE-2026-11117 demonstrating WPA2 4-way handshake PTK reinstallation and nonce reuse to illustrate the KRACK attack.
# krack_sim.py - Simulates reinstallation of an already-used PTK
import hashlib, os
class AccessPoint:
def __init__(self):
self.anonce = os.urandom(32)
self.ptk = None
def send_msg3(self, snonce):
# Normally would install PTK, but here we resend msg3 to trigger reinstall
self.ptk = hashlib.sha256(b"PMK" + self.anonce + snonce).digest()
print("Installed PTK")
return self.ptk
class Client:
def __init__(self):
self.snonce = os.urandom(32)
self.ptk = None
def receive_msg3(self, ap):
self.ptk = ap.send_msg3(self.snonce)
# Vulnerability: if AP resends msg3, nonce reuse may reset counters
print("Client installed PTK")
ap = AccessPoint()
client = Client()
client.receive_msg3(ap) # first install
client.receive_msg3(ap) # reinstallation! Nonce reused, replay possible
A Wi‑Fi client does not properly track message 3 of the 4‑way handshake. An attacker can replay message 3, causing the client to reinstall an already‑in‑use pairwise transient key (PTK), resetting nonces and replay counters. This enables decryption and forgery of frames.
Run the simulation:
python krack_sim.py
The script shows that the PTK is reinstalled, highlighting the nonce reuse.