

Plaintext Recovery Attacks Against WPA/TKIP [pdf] - yuhong
http://eprint.iacr.org/2013/748.pdf

======
yuhong
For comparison, WEP's IV field is only 24-bit.

