As you know, by hacking WPS we can get the networks PSK but my question is that does WPS exactly transfers PSK when connection established?

If so, Why does it need to send PSK? I mean, if the session is started successfully, why AP should send PSK too?

  • @schroeder So router knows that we entered the correct PIN, why it doesn't change the pin a little and encrypt packets with that? why it MUST encrypt them with PSK only? why not for example md5-ed PIN?
    – lusic
    Commented Oct 11, 2015 at 18:46
  • 1
    There we go. THAT is what you need to ask in the question.
    – schroeder
    Commented Oct 11, 2015 at 18:47
  • Then we can talk about what encryption really means.
    – schroeder
    Commented Oct 11, 2015 at 18:48
  • @lusic because the PIN had so little entropy that its security can only last for a short period of time / with few allowed authorization attempts, or else bruteforce is too easy
    – Natanael
    Commented Oct 11, 2015 at 22:20

1 Answer 1


The WPS PIN doesn't provide enough security to be used in place of the PSK. As designed, the PIN provides about 23 bits of security, about the same as a four-alphanumeric password*. The security comes entirely from the fact that WPS is immune to offline attacks, requiring the attacker to make guesses no faster than the AP being attacked will allow.

Essentially, how WPS works is that the AP and computer negotiate an encrypted but not authenticated channel, the computer and AP each perform some math to prove possession of the PIN (note that neither side ever sends the PIN over the encrypted channel), and the AP then sends the PSK and other configuration details to the computer. Since the PIN is never transmitted, the only possible attack is to repeatedly attempt to prove to the AP that you know the PIN.

If you use the PIN in place of the PSK for traffic security, offline attacks become possible because data derived from the PIN is being transmitted, and an attacker who can record the encrypted traffic can recover the PIN in a matter of seconds by checking to see which PIN would produce the derived traffic.

* As implemented, the WPS PIN provides about 13 bits of security, similar to a two-alphanumeric password.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .