How do WPA/WPA2 cracking programs know when the PMK/PTK is correct?

Question

I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a dictionary-attack on the psk how do they know when the correct pairwise master key and pairwise transient key has been found?

As I understand it, this is the rough diagram of how the WPA auth process looks like(image stolen from wikipedia):

At no point are any PMK, PTK transmitted during this process. So what exactly happens after the PMK and PTK are computed by aircrack? Does it use the PTK to decrypt a later packet in this handshake and verify some known plaintext content in the packet? How does it verify that the PMK and PTK are actually correct?

Answer 1

Pyrit upstream here.

You start by eavesdropping the key exchange between the station and the access-point. The first packet (sent from the the AP to the STA) gives you the ANonce, the second packet (sent from the STA to the AP) gives you the SNonce. You can now guess a password, compute the Pairwise Master Key and construct the Pairwise Transient Key.

There are now two possibilities:

Either you derive the Key Confirmation Key from the Pairwise Transient Key and compute the Message Integrity Code over the "virginized" packet that transfered the SNonce. You will find that your MIC matches the transfered one if your guess was correct. Make a new guess and repeat the process otherwise.

In case of WPA2-AES, one can also derive the Temporal Key from the Pairwise Transient Key and use that to decrypt some of the traffic that followed the authentication phase. If the first 6 bytes of the decrypted message turns out to look like a LLC+SNAP-protocol-header, the chance is only one in 2**48 that the guessed password is not correct. You may re-check by computing the Message Integrity Code as above. This second approach is faster than the first one as it requires less computation. You can read about the details at https://pyrit.wordpress.com/2011/04/16/known-plaintext-attack-against-ccmp/

Answer 2

No real answer since I'm no expert on the subject, but the contents of for instance ARP packets are known. They're used for cracking WEP for instance, because of their predictable content.

Answer 3

Essentially, you just check the MIC. That will prove it with reasonable reliability.