Brute force attack against WPA is the most common attack against WPA/WPA2 networks. Attacker captures the 4-way handshake that allows the authentication key to be cracked offline.
During the 4-way handshake, several pieces of information are required:
- SSID
- The key (not directly present in the exchanges)
- The MAC address of the two parties
- The nonce
The attacker can capture the challenge and the result and this allows the PMK to be deduced via a dictionary brute force attack. In particular, since PTK=F(PMK,Anonce,Snonce,APMacAddr,STAMacAddr), the attacker bruteforces PMK until finds a PTK which is coherent to the challenge-response(MIC)....
BUT, my doubt is, since the MIC is performed by using HALF of the PTK (this half is the so called KCK), then how is it possible for the attacker to find the FULL PTK?