Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So I found a diagram online, that shows the 4-way-handshake:
The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication number, once). Then the handshake continues..
What I'm struggling to see, is where WPS comes into play? When you enter a WPS pin into your cell phone or laptop, where does that kick in? Does that kick off the 4-way-handshake? Or does this skip the 4-way handshake?
Thanks.
WPS is used only once, to exchange the actual PSK key. The 4-way handshake you've posted is used for key exchange at the beginning of each connection, while WPS is only used to transfer the configuration.
WPS uses a series of 8 packets that are sent under a separate DH key exchange, and are not encrypted under WPA. There's a great description inside this paper by Viehbock on attacking WPA.
It doesn't.
The WPS PIN is used to convince the access point to give you the credentials that you will use during the handshake. This is what makes the brute-force attack on it so dangerous: even if you change the PSK, an attacker who's discovered the PIN can simply request the new PSK from the AP.
