Without using a 'fishing' homepage explicitly asking for the user to retype the WPA key. Is it possible to catch the WPA key wich is sent to a rogue AP in the initial connection phase ?


No. The "WPA key" (actually PSK) is never sent to or from the AP. The client and server both independently generate the PSK from the passphrase and SSID. As part of the handshake the client and server will both encrypt data with the PSK and send it to the other entity. That data is used to create the session key for encrypting all subsequent data between a specific client and AP pair.

The client and server authenticate each other by confirming the handshake data can be decrypted with the expected key. A rogue AP or client will not be able to do that without already knowing the PSK. Without the handshake any data sent by an entity without the PSK will not be properly decrypted which is how the counterparty identifies it as invalid.

The behavior on the client would be no different than what happens if the client is using the wrong passphrase. Now a rogue AP could perform a denial of service attack on the client by preventing the client from establishing a good connection with the real AP. This is especially true if the rogue AP signal is stronger as measured from the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.