I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds worse.
The station sends an authentication request to the access point.
The access point sends challenge text to the station.
The station uses its configured 64-bit or 128-bit default key to encrypt the challenge text, and it sends the encrypted text to the access point.
If someone is monitoring this authentication he will have the text challenge in plain text and its encrypted counterpart. Figuring out the passphrase from here on seems straight forward.
Am I understanding this correctly?