I was shocked to learn how the PTK is crafted from the PMK in WPA2 WiFi.
PMK is made with
crypt_hash(SSID + PSK). OK, seems good.
Then, the client and the Access Point (AP) make the famous 4 way handshake:
Client -> [ANonce, MACClient] -> AP Client <- [ SNonce, MACAP] <- AP Client -> OK -> AP Client <- OK <- AP
Then, the final PTK is derivated from the vector [PMK, ANonce, SNonce, MACClient, MACAP].
This is the thing that appears to be obviously ridiculous in terms of security.
If you know the PSK -> you know the PMK
If you know the PMK -> you can decrypt the 4 way handshake of another client of the WiFi (that you wifi chip is able to intercept)
If you see this 4 way handshake -> you can decrypt every further packet he will send to the AP because you know its PTK (you see the ANonce, SNonce, and MAC addresses)
This means that every client of a WiFi could be able to observe the traffic of the others clients (like an attacker doing ARP spoofing or in a network with a hub).
As we see during pentest, performing MiTM with ARP spoof can be very dangerous because very few companies actually use only ciphered protocol. You can observe telnet passwords, HTTP passwords, etc.
The main remediation is to only use ciphered protocols, I know. But the defense in depth says that the security must be applied in every layer. Here we have a layer 1 as unsecure as a global hub for the network or like connecting to a TAP interface and eveasdrop all the traffic.
Why they did not design the 4 way handshake to use something like Diffie Hellman where Client and AP only transmit non secret data to construct their secret key?
ANonce and SNonce could be replaced by Client and AP public keys. This way, anyone who can eavesdrop the 4 way handshake will not know the PTK and layer 1 will be as secured (or more) than physical cable.
I don't understand how they could do things like this. Diffie Hellman exchange key is something well known and pretty standard.
Currently, the 4 way handshake (the PTK) do not provide more security than the PMK, because knowing the PMK is sufficient to know the PTK of the others (okay you need to be here when the users is connecting).