AI
DPP: WPS’s Replacement and How It Works
Wi-Fi Easy Connect, formally Device Provisioning Protocol (DPP), is Wi-Fi Alliance’s replacement for WPS. The goal: skip typing WPA2 passwords by scanning a QR code, tapping NFC, or pairing via Bluetooth. As of the talk, only 32 certified devices across 12 vendors exist, mostly Android. DPP runs as a layer on top of WPA2 across four sub-protocols: bootstrapping, authentication, configuration, and network access. All cryptographic operations use elliptic curve cryptography. Chatzisofroniou framed the whole analysis as attacking a specification, not a single implementation.
Bypassing the Private Introduction Protocol
DPP networks advertise the DPP AKM in beacon frames, making them easy to spot. Identifying which stations connect to those networks is harder. DPP includes a private introduction sub-protocol that hides active connections from nearby devices. An attacker blocks the private peer introduction message via reactive jamming, a commodity hardware technique, and forces the station to fall back to unencrypted peer discovery. The fallback connector exposes the target SSID in plaintext. Wi-Fi Alliance labeled this an acceptable risk. Chatzisofroniou’s fix: verify protocol preferences in a later exchange and abort on mismatch.
PKEX Group Downgrade: Forcing a Weaker Elliptic Curve
PKEX, DPP’s short numeric code bootstrapping method, requires initiator and responder to agree on an elliptic curve group before any cryptographic exchange. The initiator proposes its preferred group; the responder counter-proposes if needed. An attacker jams the responder’s counter-proposal and impersonates it to propose a weaker group that both parties support but neither prefers. Impersonation works because no public keys have been exchanged yet. Weaker groups mean weaker Diffie-Hellman, making brute force easier. WPA3 includes safeguards against this; DPP does not. Wi-Fi Alliance said it would take the matter under discussion.
QR Code Bootstrapping Authenticates One Side Only
When a device scans a QR code to join a DPP network, only the access point is authenticated. The scanning device sends no certificate. Any device that scans the QR code enrolls and receives full network credentials. Organizations sometimes post QR codes on walls. Attackers can locate hidden ones via Wi-Fi triangulation. A physical duplicate fools the protocol entirely. Combining PKEX and QR code provisioning makes it worse: QR code bypasses mutual authentication while PKEX provides it. Wi-Fi Alliance called this a policy decision left to network operators.
Configurator Impersonation and the DPP Envelope Brute Force
After legitimately joining a DPP network, a malicious enrollee can claim to be a configurator. DPP supports multiple configurators in large deployments, so the protocol accepts this claim at face value. The enrollee changes the “net roll” field in its configuration request. The legitimate configurator responds with DPP envelope data, a file for backing up and restoring configurator credentials. That data is encrypted only with a password-derived key via PBKDF2. An offline dictionary attack decrypts it. Inside is the Privacy Protection Key, the credential that lets the holder issue network configurations to every enrolled device.
The Privacy Protection Key: A Network’s Single Point of Failure
The PPK is shared across all configurators and cannot be revoked. Changing the WPA2 or WPA3 password does not rotate it. An attacker who captures the PPK retains access indefinitely, regardless of password policy. Chatzisofroniou noted that subsequent DPP spec versions weakened security as vendors pushed for usability features. His recommendations: per-configurator signing keys instead of a shared PPK, a revocation mechanism, and authorization checks so devices asserting configurator status must prove that claim against a policy before receiving the envelope data.
Notable Quotes
they consider this an acceptable risk George Chatzisofroniou · ▶ 13:02
and enroll as many devices as you want. George Chatzisofroniou · ▶ 21:18
And this is the key to own everything. George Chatzisofroniou · ▶ 32:21
this is, if you ask me, this is ridiculous, right? In 2025, George Chatzisofroniou · ▶ 31:22
Key Takeaways
- QR code bootstrapping authenticates only the access point; any device with the code gets full credentials.
- Brute-forcing the DPP envelope data yields the Privacy Protection Key, granting lifetime configurator access across the whole network.
- The Privacy Protection Key is static and irrevocable; changing the WPA2 password does not affect it.
About the Speaker(s)
George Chatzisofroniou is a computer security researcher and engineer specializing in Wi-Fi and wireless network security. He has conducted penetration tests for Fortune 500 companies across Africa, Asia, Europe, and North America, and has focused on Wi-Fi security for more than 10 years. He is the author of Wi-Fi Phisher, an open source framework combining Wi-Fi association techniques with phishing strategies. His research has been presented at leading security conferences and has attracted media coverage for uncovering protocol-level vulnerabilities.