How do we know the AuthKey in Pixie Dust attack?

Question

I've been reading about the Pixie Dust attack from various sources, that provide a low-level explanation of how it works.

In the values

E-Hash1 = HMAC(AuthKey, E-S1 || PSK1 || PKE || PKR)

and

E-Hash2 = HMAC(AuthKey, E-S2 || PSK2 || PKE || PKR)

PKE and PKR are known. PSK1 and PSK2 are the first and last 4 digits of the 8-digit PIN respectively. The E-S1 and E-S2 values are supposed to be random. However, in some implementations they are generated with insecure PRNGs and can be easily guessed.

So in every description of the attack, they say that we can brute-force the PSK1 and PSK2 values and recover the PIN.

However, HMAC uses the AuthKey as secret key to generate the E-Hash values. If we don't know the AuthKey, how can we brute-force the PSK values?

I didn't find a source that incorporated the part of how the AuthKey is found. I hope that someone can shed some light on this.

Answer 1

The AuthKey is known as such:

When the registrar receives M1 he generates his public key and rnonce and can compute the

DHKey = SHA-256(g^AB mod p, 192)

and subsequently the

KDK = HMAC-SHA-256(DHKey, enonce || EnrolleeMAC|| rnonce)

Finally the AuthKey is derived as part of

AuthKey|| KeyWrapKey|| EMSK = kdf(KDK, “Wi-FiEasy andSecure Key Derivation”, [256, 128, 256]).