Logical error when performing "--gtkinit" (krack-test-client.py) ?

Hello,

I think that there might be an issue when one would want to test RSC resetting in the 4-way handshake (i.e., testing with --gtkinit). The reason could be in line 541 of the krack-test-client.py code. Here's the extract:

# 1. Test the 4-way handshake
                    if self.options.variant == TestOptions.Fourway and self.options.gtkinit and client.vuln_bcast != ClientState.VULNERABLE:
                        # Execute a new handshake to test stations that don't accept a retransmitted message 3
                        hostapd_command(self.hostapd_ctrl, "RENEW_PTK " + client.mac)
                        # TODO: wait untill 4-way handshake completed? And detect failures (it's sensitive to frame losses)?
                    elif self.options.variant == TestOptions.Fourway and not self.options.gtkinit and client.vuln_4way != ClientState.VULNERABLE:
                        # First inject a message 1 if requested using the TPTK option
                        if self.options.tptk == TestOptions.TptkReplay:
                            hostapd_command(self.hostapd_ctrl, "RESEND_M1 " + client.mac)
                        elif self.options.tptk == TestOptions.TptkRand:
                            hostapd_command(self.hostapd_ctrl, "RESEND_M1 " + client.mac + " change-anonce")

                        # Note that we rely on an encrypted message 4 as reply to detect pairwise key reinstallations reinstallations.
                        hostapd_command(self.hostapd_ctrl, "RESEND_M3 " + client.mac + (" maxrsc" if self.options.gtkinit else ""))

It seems to be that given the "elif" condition on line 533 of the code, the last line will never set the RSC to "maxrsc", since th gtkinit option is clearly excluded in the preceeding logical condition. Could this solution correct this?

# 1. Test the 4-way handshake
                    if self.options.variant == TestOptions.Fourway:
                        if self.options.gtkinit and client.vuln_bcast != ClientState.VULNERABLE:
                            # Execute a new handshake to test stations that don't accept a retransmitted message 3
                            hostapd_command(self.hostapd_ctrl, "RENEW_PTK " + client.mac)
                            # TODO: wait untill 4-way handshake completed? And detect failures (it's sensitive to frame losses)?
                        elif not self.options.gtkinit and client.vuln_4way != ClientState.VULNERABLE:
                            # First inject a message 1 if requested using the TPTK option
                            if self.options.tptk == TestOptions.TptkReplay:
                                hostapd_command(self.hostapd_ctrl, "RESEND_M1 " + client.mac)
                            elif self.options.tptk == TestOptions.TptkRand:
                                hostapd_command(self.hostapd_ctrl, "RESEND_M1 " + client.mac + " change-anonce")

                        # Note that we rely on an encrypted message 4 as reply to detect pairwise key reinstallations reinstallations.
                        hostapd_command(self.hostapd_ctrl, "RESEND_M3 " + client.mac + (" maxrsc" if self.options.gtkinit else ""))

Thanks in advance

vanhoefm / krackattacks-scripts

Logical error when performing "--gtkinit" (krack-test-client.py) ? #100