0

I wonder how a utility like Wireshark produces the PTK for decrypting packets given the 4 EAPOl packets. The way I understand it is that the PTK is generated by concatenating the PMK, ANonce, SNonce, AP MAC address and STA MAC address. ANonce and SNonce can be extracted from packets 1 and 2. AP MAC and STA MAC are open information. But how is PMK generated? PMK isn't exposed during the handshake. Is the PMK exactly the hash of the passphrase (provided by the user in Wireshark)? Perhaps, several roads of SHA1?

In fact, the PTK is the result of some pseudo-random function of the concatenation of the 5 components - what is this function?

Improve this question
6
  • does this help: security.stackexchange.com/questions/6602/…
    – schroeder ♦
    Commented Jun 20, 2017 at 14:48
  • or this? security.stackexchange.com/questions/152999/…
    – schroeder ♦
    Commented Jun 20, 2017 at 14:50
  • @schroeder Yeah, I've read that answer. But how are PMK and passphrase related?
    – John M.
    Commented Jun 20, 2017 at 14:53
  • PMK is generated by concatenating your passphrase and SSID. It is the first thing that is generated when you enter your password. Then handshake starts.
    – defalt
    Commented Jun 20, 2017 at 15:49
  • @defait Just a concatenation of the plaintext? Wikipedia suggests a pseudo-random function applied to it.
    – John M.
    Commented Jun 20, 2017 at 15:50

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .