Assume a situation where a wireless access point is using WPA2-PSK, and it is configured to allow only a single client association at one time.

Client A connects to the access point with PSK and engages in some higher layer communication with hosts accessible on the AP's network.

Client B also has the PSK, but (presumably?) cannot associate with the access point while client A is associated.

Does the limitation of a allowing only one association to the access point at a time prevent client B from using his knowledge of the PSK to sniff client A's 4-way handshake[1] and decrypt client A's traffic?

By sniffing the 4-way handshake, I mean employing the tactic described in in posts like these:



Are WPA2 connections with a shared key secure?




Any user who has the psk has the ability to decrypt all traffic encrypted with that AP using WPA2-PSK. The cipher keys are generated from that PSK all the attacker has to know is the psk and what functions the AP and Client use to generate the cipher keys, which he/she already has from previously associating themselves with access point. If the traffic has other layers, ssl for instance, well then that part of the traffic is "safe". However the Broadcast key (BES) might and should be changed by the AP whenever a client associates and also when they leave the LAN.

Some of those attacks you posted are for attackers who don't have the PSK, i.e. it changed or they never used that AP, can capture the 4-way PSK handshake which usually contains a MAC, or password-key based hash of some used-once string (nonce). The attacker can then brute-force that hash key to obtain the PSK. The key used to create the MAC is the PSK which is the password or some pseudo-derived version of it. "Deauth" Allows an attacker to kick someone off the network to force the handshake to happen again so they can capture it. Basically faking packets that tell the client to disconnect.

  • That makes sense. Thanks for the broader explanations of the different attacks, too.
    – senator
    Jan 12 '16 at 19:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.