I'm doing some pen-testing on my home wlan with aircrack-ng and it got me wondering how programs like these(eg. aircrack-ng, cowPatty, pyrit etc) really work. Specially, when performing a dictionary-attack on the psk how do they know when the correct pairwise master key and pairwise transient key has been found?
As I understand it, this is the rough diagram of how the WPA auth process looks like(image stolen from wikipedia):
At no point are any PMK, PTK transmitted during this process. So what exactly happens after the PMK and PTK are computed by aircrack? Does it use the PTK to decrypt a later packet in this handshake and verify some known plaintext content in the packet? How does it verify that the PMK and PTK are actually correct?