Of course, normally I would use HTTPS, but that's not an option in a potential scenario I don't want to get into...
This question is similar to Is it possible to secure a web app without HTTPS?, except there is no internet involved: only two devices and a good+updated access point (aka router).
How secure is the exchanged information in the following scenario:
- Server has no internet, only a LAN port to a wifi router which also has no internet.
- In the router config, a new WPA2 PSK (AES) key is applied, 15 letters+numbers long, generated by a CSPRNG.
- Another computer, "Client", connects to the router's wifi using the brand-new key and uploads a secret 50kb file to Server over HTTP (no S).
- In the router config, a brand-new PSK like above is immediately applied
- This whole time, Eve has been hiding outside with something like airdump/wireshark, perfectly recording all the Wifi traffic.
I've looked into tools like https://www.aircrack-ng.org/, but they seem to require a lot of traffic to recover PSK2 keys. I'm not an expert in this area, but it seems to me that if a lot of traffic can reveal the key, a small amount of traffic might reveal the key. If there was only the roughly 50KB worth of traffic (no de-auth, injection, etc), and the key was only active for those 30 seconds, and never used again, is there enough captured info for Eve to possibly recover the 50KB document?
I assume recovering the key is the same as being able to recover the uploaded document, but if not, my concern is not the temp key, it's the document contents.
If there is some chance of interception, is there any way to quantify/estimate the chance mathematically, based on the above figures?