Breaking Wi-Fi Easy Connect: A Security Analysis of DPP

Breaking Wi-Fi Easy Connect: A Security Analysis of DPP

Speakers: George Chatzisofroniou Conference: DEF CON 33 YouTube: https://www.youtube.com/watch?v=gMNZiDfeRPQ Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/George%20Chatzisofroniou%20-%20Breaking%20Wi-Fi%20Easy%20Connect%20A%20Security%20Analysis%20of%20DPP.pdf

Overview

Wi-Fi has a long history of protocols that trade security for convenience and then regret it. WPS — Wi-Fi Protected Setup — was designed to simplify device onboarding onto wireless networks using short numeric PIN codes. It became infamous for allowing offline brute-force attacks on those PINs, eventually leading to its widespread disablement. The Wi-Fi Alliance's answer to this embarrassment was Wi-Fi Easy Connect, also known as the Device Provisioning Protocol (DPP), officially certified from version 3.0. At DEF CON 33, George Chatzisofroniou — known in the community as "sophron" — delivered a comprehensive security and privacy analysis of Wi-Fi Easy Connect, demonstrating that the protocol's usability enhancements introduce new and sometimes worse attack surfaces than the system they were designed to replace.

Chatzisofroniou's research, which was coordinated with the Wi-Fi Alliance prior to public disclosure and also published in the International Journal of Information Security in February 2025, uncovered six distinct attack classes affecting different phases of the DPP protocol. Several of these attacks were accepted as "risks" by the Wi-Fi Alliance, meaning they have been acknowledged but not necessarily remediated in the specification. The talk is a cautionary example of how design decisions made to ease operator burden can systematically undermine the security guarantees a protocol is supposed to provide.

Background

▶ Watch: These are, you know, Wi-Fi association techniques. (0:48)

From WPS to DPP

Wi-Fi Protected Setup was introduced in 2006 and offered users a way to onboard devices onto a network without entering a long WPA2 passphrase — typically through an eight-digit PIN or a physical button press. The PIN method was broken in 2011 when Stefan Viehböck published a paper demonstrating that the PIN could be brute-forced in as little as 11,000 guesses due to a flawed verification scheme. Most routers now disable WPS by default, or at least the PIN method.

Wi-Fi Easy Connect, ratified under the DPP specification, is the intended successor. Rather than PINs, it relies on public key cryptography and elliptic curve cryptography for all operations. Bootstrapping (the initial trust establishment) happens via QR codes, NFC, Bluetooth, or a subprotocol called PKEX that uses short numeric codes similar to WPS PINs but layered in elliptic curve math. The goal is a protocol that is simultaneously secure and approachable enough for non-technical users.

As of the time of Chatzisofroniou's research, only 32 devices across 12 vendors carried Wi-Fi Easy Connect certification, predominantly Android smartphones in initiator mode. However, given that the Wi-Fi Alliance is actively pushing the protocol as WPA3's companion onboarding mechanism, broader adoption is expected.

Protocol Roles and Phases

DPP defines three overlapping role pairs for network participants:

• Station / Access Point — the standard 802.11 roles
• Initiator / Responder — who sends the first DPP message; either party can initiate
• Configurator / Enrollee — the configurator distributes credentials, the enrollee receives them

A single physical device can hold roles from all three pairs simultaneously. The protocol runs through four phases:

1. Bootstrapping — Establish trust and exchange public keys via QR code, NFC, Bluetooth, or PKEX
2. Authentication — Derive a shared symmetric key from the bootstrapped public keys
3. Configuration — Negotiate configurator/enrollee roles; the configurator issues a "connector" containing WPA2/WPA3 credentials
4. Network Access — A private introduction protocol allows stations to connect to the network without exposing their identity to passive observers

Key Findings

▶ Watch: a weaker group is quite uncommon. (20:19)

Chatzisofroniou identified six attack categories, structured around his three-phase attacker methodology: Reconnaissance, Access, and Own. The findings span all four DPP protocol phases and range from privacy bypasses to full network takeover.

| Attack | Phase | Severity | Wi-Fi Alliance Response |

|---|---|---|---|

| Private Introduction Downgrade | Network Access | Medium (privacy) | Acceptable risk |

| PKEX Group Downgrade | Bootstrapping | Medium | Under discussion |

| QR Code No Mutual Authentication | Authentication | High | Policy decision / acceptable risk |

| QR Evil Twin | Bootstrapping | High | Not addressed |

| PKEX Code Reuse (hostapd CVE) | Bootstrapping | High | Vendor bug, not spec |

| Configurator Impersonation / DPP Envelope Brute Force | Configuration | Critical | Consider alternatives / acceptable risk |

All findings were disclosed to the Wi-Fi Alliance before the talk, and the Alliance's responses are incorporated into the research.

Technical Deep Dive

▶ Watch: found is that these codes um they should not be reused, right? (28:23)

Attack 1: Private Introduction Downgrade (Reconnaissance)

DPP includes a privacy-preserving network access mechanism in which a station sends an encrypted "private peer introduction" message. If the responder supports the feature, the session continues with encrypted connector exchange, keeping the target SSID and network identity concealed from passive observers.

An attacker can defeat this by performing reactive jamming — using commodity SDR hardware to detect and block the private peer introduction message before it reaches the access point. When the private introduction fails, both parties fall back to the standard, unencrypted peer discovery exchange, which transmits the target SSID in plaintext. This allows a passive attacker to identify which network a station is trying to join and confirm that it supports DPP.

The recommended fix is straightforward: both parties should validate their privacy preferences during the subsequent exchange and abort if they do not match, as a mismatch indicates an active man-in-the-middle attack.

Attack 2: PKEX Group Downgrade (Access)

The PKEX bootstrapping subprotocol begins with an exchange of preferred elliptic curve groups. If the responder's preferred group message is jammed, an attacker can impersonate the responder using a weaker, less-preferred group — for example, group 27 instead of group 26. Because DPP has no cryptographic validation of group selection at the commit-reveal phase, neither party detects the substitution.

Using a weaker group means a weaker Diffie-Hellman exchange, making brute force attacks more tractable. This attack primarily concerns nation-state adversaries or those who believe certain elliptic curve groups have been deliberately weakened, but its presence in a modern Wi-Fi protocol specification is significant.

Attack 3: QR Code — No Mutual Authentication (Access)

QR code bootstrapping in DPP is inherently one-directional: the QR code encodes the responder's public key, but nothing encodes the initiator's public key. This means the responder has no way to authenticate the initiator. The result is an open door — any device that scans the QR code can be provisioned.

The protocol specification does allow "mixed mode" where QR and PKEX are combined, but the spec does not clearly mandate how mixed modes should behave or what security guarantees apply. An attacker who knows a network uses QR codes can simply locate a QR code (physical sticker on a router or IoT device, or locate one via Wi-Fi triangulation using DPP authentication request frames) and onboard any number of unauthorized devices.

Attack 4: QR Evil Twin (Own)

A QR code printed on paper or affixed to a device has no authentication mechanism — it is just a representation of a public key. An attacker can copy the QR code and present it on a rogue access point. Devices that scan the copied code will attempt to associate with the malicious AP rather than the legitimate one.

Attack 5: PKEX Code Reuse — hostapd CVE (Own)

In the hostapd implementation of DPP, PKEX codes and their associated ephemeral key pairs were not deleted after a single use. This violates the intended single-use semantics of the protocol. Because the code and key pair persist, an attacker who knows the PKEX code (potentially by guessing or through insider knowledge) can replay the enrollment process for additional devices or impersonate the responder by intercepting messages.

The Wi-Fi Alliance classified this as a vendor implementation bug rather than a specification flaw, though the research team notes that misconfigurations like this are predictable when the protocol structure encourages reuse.

Attack 6: Configurator Impersonation and DPP Envelope Brute Force (Own)

This is the most severe finding. The DPP configuration phase allows for multiple configurators, and nothing in the authentication phase definitively establishes which role each party will assume. A malicious enrollee can lie and claim to be a configurator. Upon doing so, it receives the DPP Envelope — a vendor mechanism for backing up and restoring configurator state across devices.

The DPP Envelope protects its contents using PBKDF2 with a password-derived key. That password-derived key ultimately protects the Privacy Protection Key (PPK) — the single asymmetric key that signs all "connectors" issued to network clients. The PPK is static, shared across all configurators, and not revocable under the current specification.

An attacker who obtains the DPP Envelope can perform an offline dictionary or brute-force attack against the PBKDF2-protected password. Recovery of the PPK gives the attacker the ability to sign fraudulent connectors for any device, providing persistent, undetectable access to the network. Because connectors signed with the PPK are indistinguishable from legitimate ones, there is no revocation path short of re-onboarding every device on the network.

Demo / PoC

▶ Watch: escalation, elevate their privileges to configurator. (34:02)

Chatzisofroniou's talk is primarily theoretical and specification-focused, reflecting the early stage of DPP adoption in real-world deployments. The attacks do not require specialized hardware beyond what any Wi-Fi security researcher would have on hand: a Wi-Fi adapter capable of monitor mode and injection for reactive jamming attacks, and standard DPP-capable software (hostapd/wpa_supplicant) for the enrollment and envelope extraction attacks.

The speaker noted that as of the talk, only 32 devices across 12 vendors carry Wi-Fi Easy Connect certification. The limited deployment surface means proof-of-concept tooling is not yet widely needed, but the protocol is expected to expand significantly as WPA3 adoption grows.

Defensive Implications

▶ Watch: Again, this is a very theoretical research at this point. (41:35)

For network operators deploying Wi-Fi Easy Connect:

• Disable mixed authentication modes wherever possible. Combining QR and PKEX without clear policy creates exploitable ambiguity.
• Enforce strict mutual authentication — require client certificates stored at the configurator and verified on each connection, rather than relying on the QR open-door model.
• Train personnel on DPP security implications. The Wi-Fi Alliance's responses to several findings amount to "this is a policy decision for operators," which means operators who are unaware of the risks will make no policy at all.
• Monitor for PKEX group negotiation anomalies in environments where DPP is deployed.
• Treat DPP Envelopes as extremely sensitive credentials — exposure of the envelope allows offline attack on the PPK.

For vendors:

• Implement per-configurator Privacy Protection Keys and a PPK revocation mechanism.
• Enforce single-use semantics for PKEX codes at the implementation level.
• Validate privacy preferences in the network access phase and abort on mismatch.

For the Wi-Fi Alliance:

• The attack surface comparison with WPS is not favorable — several DPP vulnerabilities are arguably worse than the WPS PIN attack, particularly the PPK brute-force path. Prioritizing PPK revocation and stricter group negotiation enforcement in the specification is advisable.

Key Takeaways

1. Wi-Fi Easy Connect was designed to be more secure than WPS, but usability-driven design choices have introduced new attack classes that did not exist in WPS.
2. The Private Introduction privacy feature can be trivially bypassed with a single jammed wireless frame.
3. QR code bootstrapping is inherently one-directional — it is an open enrollment door for anyone who can locate the QR code.
4. The DPP Envelope and the static, non-revocable Privacy Protection Key represent a single point of failure for the entire network's trust model.
5. The Wi-Fi Alliance classified several of these findings as "acceptable risk," shifting the burden of mitigation entirely onto network operators who may lack the training to understand the implications.
6. With only 32 certified devices currently in the wild, the deployment window for implementing fixes before widespread adoption is still open — but narrowing.

About the Speaker

George Chatzisofroniou (handle: "sophron") is a computer security researcher and engineer specializing in Wi-Fi and wireless network security. He has conducted infrastructure and software security testing for Fortune 500 companies across Africa, Asia, Europe, and North America. His research on Wi-Fi association attacks and the IEEE 802.11 specification has been published in peer-reviewed journals and presented at leading security conferences.

He is the author of wifiphisher, an open-source framework that combines Wi-Fi association attack techniques — evil twin, karma — with phishing strategies, originally presented at Security BSides London in 2015. His academic work is affiliated with Louisiana State University, and the security analysis of Wi-Fi Easy Connect was co-authored with Panayiotis Kotzanikolaou, published in the International Journal of Information Security in early 2025. The DEF CON 33 talk represents the public conference debut of that research.