4

I'm trying to understand how PSK works.

Here's what I think I know so far:

  • PSK is just the password you enter to connect to the router in your home, the PSK is stored on the router.
  • You combine the PSK with the router SSID and hash it, then I guess... you send it to authenticate? It was said the resulting key would always be unique for every session, but how would it be unique if the PSK and SSID are always the same?
  • It uses AES to encrypt... something

So can somebody please tell me how WPA2-PSK authentication works in steps?

  • 1
    "So can somebody please tell me how WPA2-PSK authentication works in steps?" Maybe go read the RFCs ? ;-) – Little Code Jun 10 '16 at 7:56
2

For a detailed description it is best you refer to the RFC, as suggested before. There are simplifying overviews, like this picture. Another helpful post might be this. The crucial point that misses in your description is that the key derived from SSID and PSK is known as "Pairwise Master Key". This is not the actual key that is used for the encryption. Instead, you can use it to compute a secret session key without passing the session key on the wire. That is what the ANounce and SNounce are used for. Then, by sending encrypted messages in step 3 and 4 AP and station prove to each other they know the PMK.

If you share a secret with someone you can always use this to authenticate to each other and compute a session key. You simply generate a bit random number, send it to your partner (encrypted with the secret). The partner decrypts it, increments by one and sends the message back (again, encrypted). Then you verify what you get is what you sent plus one.
Similar for generation of a session key. Both parties generate a random value, exchange it. Session key could be HMAC(random1+random2+secret). Even if an eavesdropper knows random1+2 he cannot generate the key because he doesn't know the secret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.