I'm trying to establish a connection to an encrypted SSID, using scapy.
My intent was basically to sniff the frames of the handshake from the victim, acting as a proxy (MITM), and redirect the frames to the actual AP, changing source and destination.
But I realized that would be impossible for me to decrypt the traffic because the only information that is encrypted, in the 4 frames, is the PMK. Am I right?
Otherwise I believe I could calculate the PTK very easily since that the rest of the data are unencrypted.

Thank you very much.

2 Answers 2


To decipher the traffic of your victim, PMK is what prevents you to figure out the PTK of that client. To generate PTK 5 things are required:

  • PMK
  • AP MAC Address
  • Client's MAC Address
  • ANonce
  • SNonce

You can capture 4 of them from the handshake except PMK. PMK is never sent over the network. The 4th frame of the handshake carries only Message Authentication Code. As long as you don't know PMK you can't decrypt the traffic.

  • You said PMK is never sent over the network, but I've been told that in WPA Enterprise the PMK is sent encrypted. Mar 7, 2017 at 20:30
  • 2
    @loopOfNegligence: You were told wrong.
    – Dog
    Mar 29, 2017 at 17:18

There is no need to act as a proxy to capture the four way handshake.

No you are wrong, the PMK is not sent, never.

The only way to decipher the PTK is almost like defalt said.

You need to be sniffing at the time the connection between the AP and the STA is being established, capturing the four way handshake. This can also be done by sending a death packet to the AP spoofing the client, so it disconnects and reconnects, hence, sending the four way handshake.

It is only the first two packets that you need of the four way handshake. The first one contain the AP MAC and the ANounce, and the second contains the Client MAC, the SNounce and the MIC to verify that the PTK match.

In order to decrypt the traffic you need to generate your own PMK also called Pre-shaked Key (PSK) then create a PTK out of it and test it to match the MIC.

  • You said never, but I've been told that in WPA Enteprise the PMK is sent encrypted. Mar 7, 2017 at 15:50
  • @loopOfNegligence You are right, It is sent encrypted and sent from the RADIUS (AAA) server to the AP because in enterprise WPA/2 the AAA is not done by the AP but the PMK (Which also has another name) is never sent to the client. And this is done typically trough wire, not trough the air.
    – Azteca
    Mar 7, 2017 at 17:14
  • Yes, is not sent to the client but at least in WPA2 Enterprise is sent encrypted (in the air or through wire) from the radius server to the AP. Instead, in WPA Personal you can confirm that is never sent? Mar 8, 2017 at 13:20
  • @loopOfNegligence Yes, absolutely, It can't be in the Probes req/res, Auth req/res nor Assoc res/res since those are general for Wi-Fi, then during WPA Personal (802.11 draft) in the four way handshake it is only used internal by each part independently, for generating the PTK, but the PMK is never sent. It's by design.
    – Azteca
    Mar 8, 2017 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .