Aircrack-ng v aircrack ptw

[ermski2k]

I know I usually prattle on about using two cards, one for capture and one for injection to speed things up. And along those lines can anyone verify that aircrack ptw can decrypt the captured and cap/ivs quicker (ie with less unique packets). I captured around 20k unique packets and both -ng and ptw gave the same key. On capturing closer to 300k aircrack-ng again produced the same key while displaying a 57% probability that the key is correct.

Can someone please verify wheather ptw is more accurate than ng, it would be interesting to see the probability of the ptw results so they could be compared. Otherwise I will just assume aircrack-ptw is just a rehash and brings nothing to the table.

Generally I can bash out a 64bit wep key in 15min and 128bit in 25min, if ptw can do this in 2-5min I would like to see proof that is more effective than aircrack-ng.

[buggs187]

You do save time. That is for sure with PTW... Ask anyone around. If you are using the program legaly then the extra few minutes with aircrack-ng is no big deal. On the other hand if you are sitting in your car in front of some random persons house trying to crack there wireless ptw time savings are perfect. JMO

[johnyt]

Aircrack-ptw has come up 100% correct every time I've tried it

[theprez98]

if ptw can do this in 2-5min I would like to see proof that is more effective than aircrack-ng.
What sort of comment is that, anyways? If it does it much faster, isn't that proof in and of itself? What more would you want to see?

I ran three clientless WEP crack tests, in each one Aircrack-ng required 800,000+ IVs. In fact, one test required over 1.5 million.

I ran three clientless WEP crack tests, in each one Aircrack-ptw required less than 40,000 IVs.

[pureh@te]

i had the same results as prez in 3 separate tests. ptw -is fur sure faster and just as acurate as far as i can tell. i ran into a key at my friends house that he claimed was secure because i guess its 150 bits or so. Ive never heard of this. it had 13 sets of hex numbers if i recall corectly. anyway the point being that ptw needed only a little less than 15000 ivs to crack in about 15 mins.wow

[lordlame]

It's an optimized algorithm.

[ermski2k]

What sort of comment is that, anyways? If it does it much faster, isn't that proof in and of itself? What more would you want to see?

I ran three clientless WEP crack tests, in each one Aircrack-ng required 800,000+ IVs. In fact, one test required over 1.5 million.

I ran three clientless WEP crack tests, in each one Aircrack-ptw required less than 40,000 IVs.

Read the whole statement. The comment means that I can get the same key as ptw out of aircrack using 5mins worth of capture!. now aircrack is compiled to only produce a key after a set number of ivs, if this is lowered you can get the key with less just like ptw, but the probablility that it is correct falls with less ivs. Is this the same. Aircrack can output a probablity for the key it finds, I want to know how this compares to ptw, does ptw give you a probability or is it 100% certain it has the correct key in every instance.

[Eristic]

Read the whole statement. The comment means that I can get the same key as ptw out of aircrack using 5mins worth of capture!. now aircrack is compiled to only produce a key after a set number of ivs, if this is lowered you can get the key with less just like ptw, but the probablility that it is correct falls with less ivs. Is this the same. Aircrack can output a probablity for the key it finds, I want to know how this compares to ptw, does ptw give you a probability or is it 100% certain it has the correct key in every instance.

I have never had ptw give me the key until it found it. WHen it did find it, it has always worked 100% of the time. Perhaps you should read the white paper produced by the creators of ptw.

http://eprint.iacr.org/2007/120

[ermski2k]

Excellent, many thanks, so as the abstract from the creators says....

We demonstrate an active attack on the WEP protocol that is able to recover a 104-bit WEP key using less than 40,000 frames in 50% of all cases.

So probablitiy on 104bit wep is 50% so to me it seems that it does exactly the same as aircrack on 5min worth of capture, as stated in my first post where aircrack gave me 57%. The only difference being that ptw can be started at a lower iv count where as aircracks standard limit is set higher. Not really surprised, but i guess some people dont read posts and dont understand, but hope you enjoyed running 1.5m ivs!

As for the Optimised algorithm myth I think aircrack is on a higher version number so would that not therefore compute to the algorithm being optimised somewhere down the line already by the creators of aircrack. Plus it helps if aircrack already incorporates ptw somewhere down the line already

Aircrack-ng is the next generation of aircrack with lots of new features:
Better documentation (wiki, manpages) and support (Forum (http://forum.tinyshell.be/), trac (http://trac.aircrack-ng.org/), IRC: #aircrack-ng on Freenode (irc://irc.freenode.net/aircrack-ng)).
More cards/drivers supported
New WEP attack: PTW (http://www.cdc.informatik.tu-darmstadt.de/aircrack-ptw/)
More OS and plateforms supported
Fragmentation attack
Improved cracking speed
WEP dictionnary attack
Capture with multiple cards
New tools: airtun-ng (http://www.aircrack-ng.org/doku.php?id=airtun-ng), packetforge-ng (http://www.aircrack-ng.org/doku.php?id=packetforge-ng) (improved arpforge)
Optimizations, other improvements and bug fixing

[rumburak514]

I would like to see proof that is more effective than aircrack-ng.
There are two different tools. Aircrack-ng is a WEP and WPA cracker
with WEP dictionary attack and will incorporate aircrack-ptw.
So far aircrack-ptw is a proof-of-concept tool that works only under certain conditions.
Klein's attack of breaking RC4 (the tech. aircrack-ptw bases on) is faster that Korek's attack way in aircrack-ng, but so far tool aircrack-ptw heavily depends on the data collected.
To compare both you need a .cap file with ARP requests/responses and with WEP 64 or 128 bit.
In this case the technique implemented by ptw needs only appr. 15-20 % of data needed by aircrack-ng to break the key.
But when you have .ivs file or no ARP-s in .cap aircrack-ptw simply doesn't work.

[theprez98]

Read the whole statement. The comment means that I can get the same key as ptw out of aircrack using 5mins worth of capture!. now aircrack is compiled to only produce a key after a set number of ivs, if this is lowered you can get the key with less just like ptw, but the probablility that it is correct falls with less ivs. Is this the same. Aircrack can output a probablity for the key it finds, I want to know how this compares to ptw, does ptw give you a probability or is it 100% certain it has the correct key in every instance.
Ok, so you're asking what is the "false positive" rate for Aircrack-ng vs. Aircrack-ptw? In other words, what % of the time do these programs give you a key that is actually incorrect?

I have used both programs rather extensively and have never had either program give me a key that was actually incorrect. Since it is "solving" they key and not really "guessing", I'm not sure a false positive is even possible. If it doesn't know the key for sure, the crack will just fail.