What initialization vector (IV) length do most weak WEP implementations use?

• A. 16 bit
• B. 24 bit
• C. 32 bit
• D. 64 bit

Answer: (B)

The length of the IV matters because it determines how often the same RC4 keystream can be reused across packets. In WEP, the IV is 24 bits and is combined with the secret key to form the per-packet RC4 key, and this IV is transmitted in the clear. With only 24 bits, there are about 16.7 million possible IVs, which means that in a busy wireless network IVs repeat frequently. When the same RC4 key is used for multiple frames, attackers can compare the resulting ciphertexts and exploit RC4 biases and WEP's weak integrity checks to deduce information about the plaintext or even recover the key. This vulnerability is why 24-bit IVs lead to weak WEP, making 24 bits the standard IV length associated with these weaknesses. Longer IVs would reduce collision chances but are not how WEP was designed; shorter ones would be even more susceptible to IV reuse.