So I found a diagram online, that shows the 4-way-handshake:

enter image description here

The way I understand it, when a station (STA) is trying to authenticate to an access point (AP), the AP sends the ANonce (authentication number, once). Then the handshake continues..

What I'm struggling to see, is where WPS comes into play? When you enter a WPS pin into your cell phone or laptop, where does that kick in? Does that kick off the 4-way-handshake? Or does this skip the 4-way handshake?


  • 1
    WPS must come before this stuff, because the STA does not the master secret and so cannot compute a PTK.
    – curiousguy
    Oct 3, 2013 at 19:57

2 Answers 2


WPS is used only once, to exchange the actual PSK key. The 4-way handshake you've posted is used for key exchange at the beginning of each connection, while WPS is only used to transfer the configuration.

WPS uses a series of 8 packets that are sent under a separate DH key exchange, and are not encrypted under WPA. There's a great description inside this paper by Viehbock on attacking WPA.


It doesn't.

The WPS PIN is used to convince the access point to give you the credentials that you will use during the handshake. This is what makes the brute-force attack on it so dangerous: even if you change the PSK, an attacker who's discovered the PIN can simply request the new PSK from the AP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.