Which of the following BEST describes the weakness in WEP encryption?

A.
The initialization vector of WEP uses a crack-able RC4 encryption algorithm.
Once enough packets are captured an XOR operation can be performed and the asymmetric keys can be
derived.

B.
The WEP key is stored in plain text and split in portions across 224 packets of random data.
Once enough packets are sniffed the IV portion of the packets can be removed leaving the plain text key.

C.
The WEP key has a weak MD4 hashing algorithm used.
A simple rainbow table can be used to generate key possibilities due to MD4 collisions.

D.
The WEP key is stored with a very small pool of random numbers to make the cipher text.
As the random numbers are often reused it becomes easy to derive the remaining WEP key.

Explanation:
WEP is based on RC4, but due to errors in design and implementation, WEP is weak in a number of areas,
two of which are the use of a static common key and poor implementation of initiation vectors (IVs).
When the WEP key is discovered, the attacker can join the network and then listen in on all other wireless
client communications.
Incorrect Answers:
A: RC4 itself is not crack-able, but the IV that is crack-able.B: The initialization vector (IV) that WEP uses for encryption is 24-bit and IVs are reused with the same
key. By examining the repeating result, it is easy for intruders to crack the WEP secret key, known as an IV
attack.
C: WEP does not use the MD4 hashing algorithm, but RC4.

Dulaney, Emmett and Chuck Eastton, CompTIA Security+ Study Guide, 6th Edition, Sybex, Indianapolis,
2014, p. 189