OpenBSD - Inverted TKIP MIC-Failure Countermeasure Condition

Executive Summary

ieee80211_michael_mic_failure() in sys/net80211/ieee80211_crypto_tkip.c decides whether a Michael MIC failure should activate TKIP countermeasures. Per IEEE 802.11-2012 §11.4.2.4, and per the comment directly above the code, countermeasures belong on a second MIC failure within 60 seconds of the first. The comparison was written the other way round, so the function returned early exactly when the two failures fell inside the window and fell through into the countermeasure path only when they did not.

Details

The check read:

now = getuptime();
if (ic->ic_tkip_micfail == 0 || ic->ic_tkip_micfail + 60 >= now) {
    ic->ic_tkip_micfail = now;
    ic->ic_tkip_micfail_last_tsc = tsc;
    return;
}

ic_tkip_micfail + 60 >= now is true while 60 seconds or less have elapsed since the previous failure, which is the case the standard wants countermeasures for, and that is the branch that returns without acting. Once more than 60 seconds have passed the condition is false, control falls through, and the countermeasures run. The operator needed to be <.

The countermeasure path is not cheap. In HostAP mode it sets IEEE80211_F_COUNTERM, refuses new TKIP associations for 60 to 90 seconds, deauthenticates every associated TKIP station through ieee80211_iterate_nodes(ic, ieee80211_tkip_deauth, ic), and schedules a GTK change. In STA mode it sends two MIC failure reports and deauthenticates from the AP.

Reachability

Both entry points are reachable from received frames with no authentication: the decryption path via ieee80211_tkip_decrypt(), and the EAPOL path via ieee80211_pae_input.c. An attacker only needs to be within RF range of the interface.

Impact

Two consequences, in opposite directions.

An attacker in range sends one malformed TKIP frame, waits more than 60 seconds, then sends a second. Because the failures fall outside the window, the countermeasures activate: on an access point that tears down every TKIP client and blocks reassociation for up to 90 seconds. The sequence is repeatable indefinitely and needs no credentials, which turns the defense itself into a remote denial of service.

In the other direction, a Beck-Tews style key-cracking attempt produces its MIC failures in quick succession, inside the 60-second window, and those are precisely the ones the inverted test discards. The mechanism that exists to deter that attack does not engage.

Exposure is bounded by configuration rather than by the bug: TKIP is disabled by default on OpenBSD, so only WPA1/TKIP deployments are affected.

Remediation

Update to a kernel containing 1ee99dfcc4d, which changes the comparison to ic->ic_tkip_micfail + 60 < now.

Timeline

• 2026-06-18 — Reported to OpenBSD
• 2026-07-15 — Fixed in 1ee99dfcc4d (ieee80211_crypto_tkip.c rev 1.34)
• 2026-08-06 — Public disclosure