Recovering an IoT pairing key from two packets
The pairing counter resets on every reboot, so the same nonce gets used twice. With two captured handshakes, the session key can be recovered.
The full write-up for this one isn't online yet.
The pairing counter resets on every reboot, so the same nonce gets used twice. With two captured handshakes, the session key can be recovered.
The full write-up for this one isn't online yet.