Skip to content

Instantly share code, notes, and snippets.

@serious-angel

serious-angel/1_80211_wpa2_flow.md

Last active September 20, 2026 08:40
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save serious-angel/21ac6ae353dc426a2194c2e7e9dca093 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save serious-angel/21ac6ae353dc426a2194c2e7e9dca093 to your computer and use it in GitHub Desktop.
Download ZIP
General 802.11 WPA2 flow
Raw
1_80211_wpa2_flow.md

Wonderful day!

Greetings, from Libera IRC! ^^
Just in case, no awful sorrowful LLM was used for this Gist.

Though, there's a lot of various articles about it, but sometimes it's better to recall it all manually, I believe.

The bellow chart is a 4-way handshake general representation I copied from a personal security paper I had prepared long ago for another project, with the dear four EAPOL-Key messages constituting the core of WPA2 network authentication, during which keys are generated and distributed between the client and the authentication system.

EAP over LAN (EAPoL or EAPOL) is an 802.1X-defined technique for encapsulating EAP or user data within LAN or WLAN networks.

Depending on the configuration, WPA2 and WPA3 networks can support various authentication systems, including 802.1X and the infamous Pre-Shared Key (PSK).

"Personal" networks are generally considered a simplified version of "Enterprise" networks, with the latter potentially involving diverse authentication methods—such as username/password combinations, certificates, or proprietary systems—supported by 802.1X (e.g., Robust Security Network (RSN)).

Here we focus primarily on an environment featuring a WPA2-Personal access point (AP) configuration that utilizes PSK authentication.

image

The Access Point (AP) - authenticator. The Station (client) - supplicant.

  1. The Access Point (AP) broadcasts a Beacon frame to notify stations within range of its presence (each 100ms, usually). This frame contains critical AP information, including authentication mechanisms, supported capabilities, operational constraints;
  2. The station transmits a Probe Request frame (either directed to a specific AP or broadcast to all APs within range) to evaluate available network characteristics and select an optimal connection target;
  3. Depending on the request type, one or more APs respond with a Probe Response frame;
  4. The station initiates an OSA request (Open System Authentication) for the required AP;
  5. The AP returns an OSA response;
  6. Ignoring or evaluating other network characteristics, the station sends an Authentication Request frame containing the AP's SSID and station parameters;
  7. The AP validates the station parameters against its local configuration and transmits security parameter details in plaintext;

// EAPOL 4 messages (Start)

  1. [M1] The AP generates a pseudo-random ANonce and transmits it to the station;
  2. [M2] Possessing the dear lovely correct PSK, the station holds all variables required to derive the PMK and PTK, calculates MIC1, and transmits the frame counter (r) with the precious SNonce to the AP;
  3. [M3] Upon receiving r, SNonce, and MIC1, the AP derives the PMK and PTK, verifies MIC1, and (upon a successful match) validates the authentication payload. The AP then increments r, computes MIC2, and sends an M3 frame containing the also precious ANonce, along with an AES-KEK encrypted Group Temporal Key (GTK) if dynamic key management is supported;
  4. [M4] If GTK distribution is supported, the station decrypts the GTK, computes MIC3, and sends this M4 frame to acknowledge successful receipt of all security parameters;

// EAPOL 4 messages (End)

  1. [Authorized Data Transfer] Data frames between the station and the AP are encrypted using the derived keying "material";
  2. [Data Transfer] I.e., continuation as in Step 12;
  3. [Deauthentication (Client)] The client issues a Deauthentication notification frame for the AP, marking the client state as unauthenticated and dropping subsequent encrypted data frames until a new session is established;
  4. [Deauthentication (AP)] The AP sends Deauthentication notification frame signaling that the authenticated session has terminated and re-association is required to resume data transfer.

We may see the monitored 802.11 traffic in Wireshark. For example, I've tried filtering the required frames matching the chart above:

image

As of 2026, if I am not mistaken, the WPA PSK is still primarily the result of the Password-Based Key Derivation Function 2 (PBKDF2), which incorporates a pseudorandom function (PRF) such as HMAC-SHA1.

In case of WPA2-Personal, the PMK is 256 bits from the following 4096 buts, computed offline beforehand via the following:

PMK = PBKDF2(
    PSK,        // Key
    HMAC-SHA-1, // Hash type
    SSID,       // Data
    4096        // Length
);

In WPA2-Enterprise, it is derived within a whole 802.1X/EAP authentication.

Pairwise Transient Key (PTK) is a 512-bit key resulting from a KDF function applied to five concatenated key values:

// MAC_AP  - MAC address of the AP
// MAC_STA - MAC address of the station (client)

Mac1   = Min(MAC_AP, MAC_STA);
Mac2   = Max(MAC_AP, MAC_STA);
Nonce1 = Min(ANonce, SNonce);
Nonce2 = Max(ANonce, SNonce);

PTK = PBKDF2(
    PMK,
    HMAC-SHA-1,
    "Pairwise key expansion" + Mac1 + Mac2 + Nonce1 + Nonce2,
    4096
);

The "Pairwise key expansion" is a literal text, indeed.

The Pairwise Transient Key (PTK) is subsequently subdivided into the following five keys (128, 128, 128, 64, and 64 bits, respectively):

  • [128] Key Confirmation Key (KCK) - Used to generate the Message Integrity Code (MIC) for messages exchanged during the 4-Way Handshake and the Group Key handshake to verify frame authenticity and integrity.
  • [128] Key Encryption Key (KEK) - Used to encrypt and decrypt the Group Temporal Key (GTK) transmitted within the mentioned above EAPOL M3.
  • [128] Temporal Key (TK) - Used to encrypt and decrypt payloads within 802.11 MAC Service Data Units (MSDUs) transmitted between the Supplicant and Authenticator.
  • [64] Temporal Mic1 TX Key - Used to compute the MIC for unicast data frames transmitted by the Access Point (Authenticator).
  • [64] Temporal Mic2 RX Key - Used to compute the MIC for unicast data frames transmitted by the Station (Supplicant).

The Group Temporal Key (GTK) is subsequently subdivided into the following three keys (128, 64, and 64 bits, respectively):

  • [128] Group Temporal Encryption Key (GTE) - Used to encrypt and decrypt multicast and broadcast network traffic.
  • [64] Temporal Mic1 TX Key - Used to compute the MIC for multicast and broadcast data frames transmitted by the Access Point (Authenticator).
  • [64] Temporal Mic2 RX key - Currently unutilized, as WPA/WPA2 stations (Supplicants) do not transmit multicast or broadcast frames to the AP.

Tht is, the M1 and M2, or M3 and M2 is enough for the handshake, since they contain the precious nonces.

Therefore, if you monitor that dear IEEE 802.11 traffic and catch these EAPOL messages, with these precious nonces, knowing MAC addresses, you may now brute-force the PSK, since you have all the required for the PBKDF2 hash, including Mics to verify it.

Encrypted 802.11 traffic
image image

Let's decrypt it!

Set PSK (Wireshark)
Visible DNS queries Visible DNS and TCP
image image
Visible DNS queries Visible DNS and TCP
image image

At voila!

Here, please do upgrade to WPA3 to keep it more secure against a quite easy "Deauth" attack, where the frame mentioned in the chart's Step 15 (Deauthentication frame) is forged and injected in the 802.11 traffic as if broadcasted orignating from the AP.

Since, if station considers the session obsolete, it may initiate another EAPOL flow, and if monitored, reveal the whole handshake for that specific 802.11 session.

The 802.11 session mentioned is important, since if you have PSK, the Nonces are still required to decrypt the specific session between the client/supplicant and the AP.

You may find the fllowing interesting:

Please do stay safe!

  • "You have to know the past to understand the present" ~ Carl Sagan

Related

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment