The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of course you know the password, because you created the fake AP. But if you're performing a real attack, and you created a fake AP with the same essid of a real AP, the clients when trying to connect to the fake AP (that act as MITM) won't be able to since the pre-shared key is different. So, since the pre-shared key is a mismatch you will never be able to reinstall the PTK or GTK because you wouldn't get all the frames you need to replay them. Am I correct?

Same thing for the script to test the real AP. If you know the pre-shared key of the real AP, assuming it supports FT, then you can go ahead and connect to it to do the propers tests regarding packet number reusing. But if you don't know the pre-shared key, if the AP is vulnerable, how are you going to get the all frames of the handshake?

I think with a pre-shared key mismatch you would get only message 1 and 2 of the handshake.


To the main question: It doesn't, to do the channel-based MITM you need to have the PSK, as you said, this in order to be able to get the 3rd message of the 4-way handshake.

To your first and last assumption: Yes you're correct!

As this question answers in the Q&A

If an attacker can do a man-in-the-middle attack, why can't they just decrypt all the data?

As mentioned in the demonstration, the attacker first obtains a man-in-the-middle (MitM) position between the victim and the real Wi-Fi network (called a channel-based MitM position). However, this MitM position does not enable the attacker to decrypt packets

Also in the paper (PDF) section 3.2 The Key Reinstallation Attack

A second minor obstacle is that we must obtain a MitM position between the client and AP.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.