We know that WPA/WPA2-PSK uses a PTK (Pairwise Transient Key) for each client to encrypt the communication. This PTK is generated through the process known as 4-way handshake. As told in the related page on Wikipedia:
The PTK is generated by concatenating the following attributes: PMK, AP nonce (ANonce), STA nonce (SNonce), AP MAC address, and STA MAC address. The product is then put through a cryptographic hash function.
So, if an attacker has the ability to setup a rogue AP (Access point) and make some clients automatically deauth & connect (especially mobile clients) to that rogue AP of his, can he gain some advantage to speed up calculations for cracking the PSK by introducing some specially generated inputs for example ANonce, AP MAC -the variables which he can control-?
We can assume that he has the chance to do this for some reasonable times such as 10. So he will obtain that number of 4-way handshakes which he used some specially selected inputs (similar to a chosen-plaintext attack). I wonder if there is some component in the design which will prevent that he gains some speed advantage by using a rogue AP rather than simply capturing the 4-way handshakes?