Described attack works only with one essential restriction: WAP and wireless client doesn't "see" each other:
"An access point and a client cannot be communicated directly since the
interval between these is large. The attacker behaves like a repeater, namely all packets that include SSID beacon are relaid to the receiver with no modification, and the packet of the access point/client delivers to the client/access point."
http://jwis2009.nsysu.edu.tw/location/paper/A%20Practical%20Message%20Falsification%20Attack%20on%20WPA.pdfMiTM attacker must work with two directional antennas: one for WAP and one for wireless client. If WAP and wireless client "see" each other, attacker sending chochop guess to WAP, WAP respond with MIC failure and wireless client change TSC (TKIP Sequence Counter) and attack fails. Such restriction hasn't previous Beck-Tews attack, which works nicely with tkiptun-ng from aircrack-ng-1.0 suite, but also have other restrictions: WAP and wireless client must works in WMM(WiFi MultiMedia- QoS according 802.11e standard) mode and rekeying interval is more than 1200 secs. In both attacks attacker get MIC key and RC4 keystreams only, not TKIP pairwise or group keys itself. Attacker with decrypted RC4 keystream can fake arp and dns packets only.
===========
GCIH, Security+