Since encryption keys are session-based in WPA2 enterprise, if person A obtains person B's credentials, will person B's encryption key still be safe? Is there any way person A could use person B's credentials to find the encryption key for a given session?

1 Answer 1


Basically, it is 802.1x. Key derivation is complicated. There is a high-level explanation here: http://www.tldp.org/HOWTO/8021X-HOWTO/intro.html

To answer your question simply, the key (actually there are several keys) is agreed upon by the AP and client based on another key issued by the authenticating RADIUS server. All of these keys are (ephemeral) session keys, with the exception of the group transient key, which is shared between clients (for multicast and broadcast) but periodically changed.

Simply knowing credentials will not cause you to arrive at the same set of keys as another user of the same credentials, or even the same set of keys you had the last time you authenticated. Any credentials at all will get you the group transient key, but unicast traffic remains secure.

As with all such things, there is an attack. To render that traffic insecure, an attacker could set up a rogue AP which acts as a gateway, allowing the target to authenticate to it and in turn authenticating with its credentials to the network. This is an active MitM, though, not a passive disclosure like you were worried about.

  • ok, so just to be 100% clear, given an non-compromised AP, knowing the credentials of a user connected to that AP absolutely does not help an attacker deduce that user's encryption key. right?
    – raladdin
    Commented Feb 10, 2014 at 15:48
  • Not like that, no. It's bad for many reasons but that is not one of them. Commented Feb 10, 2014 at 18:13
  • Could you expand on the reasons?
    – raladdin
    Commented Feb 10, 2014 at 19:10
  • Specifically the fact that the attacker would then be on your LAN, and also that they could do things like create a rogue AP or MitM traffic. Commented Feb 10, 2014 at 20:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .