docrice
join:2008-03-31
Fremont, CA
| reply to Lasko
Re: WPA
I'd like to clarify this a bit since people tend to be vague on this particular area. The WPA passphrase is used in conjunction with the SSID value and the SSID length, the hash of which results in the Pairwise Master Key (PMK). This is the first-stage secret that the station and AP share. The secret element, of course, is the passphrase because everything else is out in the open.
With both the station and AP having calculated the same PMK, the next step is to perform a 4-way handshake which involves each side sending a dynamically-generated nonce value. Each side uses these values, along with the hardware addresses of both nodes, to calculate the Pairwise Transient Key (PTK). The PTK is composed of multiple sub-keys such as the EAPOL Key Encryption Key (KEK), EAPOL Key Confirmation Key (KCK), as well as the Temporal Key (TK).
It's the stuff that makes up the PTK which does the actual encryption, namely the Temporal Key for unicast packets. The 4-way handshake is exposed clear text. If you capture the WPA session setup traffic during 802.11 and WPA negotiation, you can see these nonce values being passed along with the GTK and any ACKs.
Attackers need to figure out two things to crack WPA traffic: the PMK value and the session-specific 4-way handshake nonce values. Therefore, protecting the PMK in a pre-shared key environment by selecting a strong passphrase is crucial because everything else can be seen via monitor mode on a 802.11-capable network interface. |
