I wonder how a utility like Wireshark produces the PTK for decrypting packets given the 4 EAPOl packets. The way I understand it is that the PTK is generated by concatenating the PMK, ANonce, SNonce, AP MAC address and STA MAC address. ANonce and SNonce can be extracted from packets 1 and 2. AP MAC and STA MAC are open information. But how is PMK generated? PMK isn't exposed during the handshake. Is the PMK exactly the hash of the passphrase (provided by the user in Wireshark)? Perhaps, several roads of SHA1?

In fact, the PTK is the result of some pseudo-random function of the concatenation of the 5 components - what is this function?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.