I wonder how a utility like Wireshark produces the PTK for decrypting packets given the 4 EAPOl packets. The way I understand it is that the PTK is generated by concatenating the PMK, ANonce, SNonce, AP MAC address and STA MAC address. ANonce and SNonce can be extracted from packets 1 and 2. AP MAC and STA MAC are open information. But how is PMK generated? PMK isn't exposed during the handshake. Is the PMK exactly the hash of the passphrase (provided by the user in Wireshark)? Perhaps, several roads of SHA1?
In fact, the PTK is the result of some pseudo-random function of the concatenation of the 5 components - what is this function?