If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?

  • You should try to reformulate your question to add more context about what exactly you're asking about, it pretty much has to be guessed at this point. – Dillinur Mar 27 '15 at 10:34

The difference between the two keys is that the Master key (PMK) is supposed to be valid for at least as long as the client is connected. In the case of WPA-PSK, the PMK is the same from the moment the AP is configured until either the passphrase or the SSID changes. Therefore, if the PMK is compromised in any way, the attacker gains "permanent" access to the network.

To protect the PMK, the protocol derives a pair of Transient keys (PTK and GTK) that are used to directly encrypt communications. These may be expired and renegotiated several times in the course of the client's connection, and the compromise of either of them does not gain the attacker permanent access to the network. The next time the client connects, it will generate a new pair of Transient keys from random values generated on the AP and the client, combined with the PMK.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.