No password is ever sent during the 4-way handshake, therefore it cannot be phished.
When a client connects to an access point (AP) using WPA2-PSK, the password or pre-shared key (PSK) is, as the name suggests, already known by both parties. So there is no need to exchange it again.
Do not confuse this with other scenarios where no pre-shared secret is available. (Say, you're connecting to a website via SSL and need to perform a Diffie-Hellman key exchange beforehand.)
Naively, the client and AP could simply go along and use symmetric encryption (e.g. AES) to communicate confidentially. They would use the PSK as the only encryption key without any preceding handshakes or additional key exchanges. However, this approach is flawed since it uses the same key for evey message and neither party had to prove its identity, thus opening the door for replay attacks, etc.
So, the purpose of the 4-way handshake is not to exchange a passphrase, but to prove to the other party that you actually know the PSK (respectively, a PMK which you can consider equivalent here) and establish a pairwise transient key (PTK). This PTK combines the keys that will be finally used for the actual encrypted data transfer.
The proof of knowing the PSK happens when both parties use it to generate a message integrity code (MIC) that will be sent along with the random nonce values during the handshake. Therefore, a handshake between your evil twin and a legitimate client would look like this:
- Your rogue AP generates a random nonce (ANonce) and sends it to the client.
- The client chooses a nonce (SNonce) and is now able to compute the PTK. It sends the nonce along with a MIC generated from the key.
- Now your AP has to send back a group temporal key (GTK) with the corresponding MIC. Since you can't generate the MIC without knowing the PSK, the client will reject your response and the authentication fails.