Step 166. Wireless Security: WPA2 and the Handshake — Key Material Floating in the Air

Level 2 — Introduction to Security and Attack Skill Basics | Difficulty ★★★☆☆ | Estimated time: 2.5 hours

Prerequisites: Step 34 (ports and services) and Steps 122–124 (the password attack series) complete. You know the concepts of hashes and offline cracking.

What you need: writing tools (you’ll draw the handshake sequence diagram yourself), (optional) a monitor-mode-capable wireless adapter + your own router
Chapter type: today is a [concept] chapter. Wireless measurement requires equipment, so this chapter’s commands and screens are output examples.
Ethical/legal boundary: wireless attacks are especially dangerous because there’s no physical boundary. A neighbor’s, café’s, or company’s AP can never be a target — it’s a clear crime under radio-wave and telecommunications law. Even with equipment, practice happens only between a router I own and my own devices. This chapter’s goal is not executing the attack but structurally understanding why a strong password is the only defense.

A wired network’s packets travel inside a cable, but wireless packets are broadcast into the air — anyone with an antenna can receive them. How does WPA2 protect the password in this situation? The answer: "it never sends the password." Instead, the four messages exchanged at every connection — the 4-way handshake — carry "a verification value only someone who knows the password can produce."

The problem is that this verification value floats in the air. Capture it and take it home, and Step 124’s offline cracking is waiting — a world with no server, no lockout, no logs, where you can try passwords without limit. Today you dissect this structure to the end and organize exactly which points WPA3 fixed.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the four messages of the WPA2 4-way handshake in order
Draw the key-derivation structure running PMK → PTK → MIC
Explain why a handshake capture leads to offline cracking
State how the PMKID attack differs from handshake capture
Organize what WPA3 (SAE) fixed — and the password problem that remains anyway

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Concept-focused — reading the aircrack-ng suite’s commands (output examples)
Today’s commands	`airmon-ng`, `airodump-ng`, `aireplay-ng`, `aircrack-ng` (for structural understanding)
Concepts needed	PMK/PTK/MIC, nonces, offline cracking, PMKID, SAE
Today’s artifact	one handshake sequence diagram + a WPA2 vs WPA3 comparison table

2-1. The Password Never Rides the Radio Waves

In WPA2-PSK (the standard for home Wi-Fi), the router password never rides in any packet. Instead, a PMK (Pairwise Master Key) pre-made from the password and the network name (SSID) is the root of everything. The handshake is how the router and the device prove "we both know the PMK" without sending the PMK itself.

You’ve already met the structure of confirming knowledge without sending the secret — the same family as hash verification in web logins and SSH’s key exchange.

2-2. The 4-Way Handshake — Four Messages

The four messages exchanged when a device (client) connects to the router (AP).

AP                                     Device
 | --- (1) ANonce (AP's random number) ----> |
 | <--- (2) SNonce + MIC --------------- |
 | --- (3) GTK install + MIC -------------> |
 | <--- (4) Confirmation ------------------ |

(1) The AP sends a random number, ANonce.
(2) The device creates its own random number, SNonce, and computes the PTK (Pairwise Transient Key) from PMK + ANonce + SNonce + both MAC addresses. It then sends along a MIC (Message Integrity Code) made with the PTK — proof saying "I built the PTK, which I could only do if I know the PMK."
(3) The AP computes the PTK from the same ingredients and compares it against the received MIC. If it matches, it delivers the group key (GTK).
(4) The device confirms. From then on, traffic is encrypted with PTK/GTK.

The core: message (2)’s MIC is all the verification material. An eavesdropper can receive the ANonce, SNonce, both MACs, and the MIC — the only thing missing is the PMK, and the PMK comes from the password.

2-3. Why Offline Cracking Works

Follow the eavesdropper’s computation.

Pick one password candidate (password123, etc.)
Make a candidate PMK from candidate + SSID
Make a candidate PTK from candidate PMK + (the eavesdropped) ANonce/SNonce/MACs
Compute the MIC with the candidate PTK and compare it to the eavesdropped MIC
If equal — that candidate is the real password

Exactly the same shape as Step 124’s hash cracking. The handshake file is itself "a crackable hash." With no server, there’s no lockout and no rate limiting — a GPU at full throttle can try hundreds of thousands per second. This is the structural reason "a Wi-Fi password must be long and unique."

2-4. PMKID — An Attack That Needs No Connection at All

The PMKID attack, published in 2018, is quieter. Many APs include a value called PMKID in the first response to a connection request, and it’s a hash made from the PMK and the AP’s MAC, among others. In other words, without waiting for another device to connect, sending one request to the AP and receiving the PMKID completes the offline-cracking material.

Classic handshake capture needed the commotion of "disconnecting a connected device to induce reconnection (a deauthentication attack)"; PMKID skips even that. For defenders, it means there are even fewer events to detect.

2-5. WPA3 — What Changed

WPA3 replaced the handshake with SAE (Simultaneous Authentication of Equals, the Dragonfly handshake).

Item	WPA2-PSK	WPA3-SAE
Core material	A fixed PMK derived from the password	A fresh key agreement every session
Offline cracking after capture	Possible (MIC substitution)	Impossible — captured data has no answer form to test against
Forward secrecy	None	Yes — past traffic stays safe even if the password leaks later
Management frame protection	Optional	Mandatory — deauthentication attacks neutralized

The essential change: SAE doesn’t use the password as "direct material" but agrees on a fresh key every time, so eavesdropped packets never become an offline-guessing workbook. That said, a weak password itself is still dangerous — online guessing and dictionary-based attempts remain, and in WPA2/WPA3 mixed (transition) mode there’s room for downgrade attacks pulling clients toward the WPA2 side.

3. Follow Along

Today’s follow-along is practice in "reproducing the structure by hand." Only those with equipment actually run 3-4; for everyone else, reading the output examples is enough.

3-1. The aircrack-ng Suite — Reading Four Tools’ Roles

The aircrack-ng suite, the standard toolkit for wireless attacks, has names that are their roles.

Tool	What it does	In metaphor
`airmon-ng`	Switches the wireless card to monitor mode	An ear into the air
`airodump-ng`	Collects and displays nearby APs and clients	An eavesdropping recorder
`aireplay-ng`	Injects packets like deauthentication	Inducing reconnection
`aircrack-ng`	Substitutes a wordlist against a capture file	The offline cracker

How to read it: chain the four in order and you get the whole flow of "open an ear → record → gather material → substitute back home." Memorizing this pipeline comes before each tool’s detailed options.

3-2. Drawing the Handshake Sequence by Hand

Close the book and draw 2-2’s four messages. But be sure to write three things next to each arrow.

The value carried in that message (ANonce? SNonce? MIC?)
The ingredients needed to make that message (PMK? PTK?)
What an eavesdropper gains from this message

Reference example (compare with your drawing):

(1) AP → Device : ANonce
    Eavesdropper's harvest: ANonce (cracking material 1)
(2) Device → AP : SNonce + MIC
    Eavesdropper's harvest: SNonce + MIC (material complete — offline cracking possible from this point)
(3) AP → Device : GTK (delivered encrypted)
(4) Device → AP : Confirmation

How to read it: that message (2) alone completes the eavesdropper’s material — this is the point you must discover yourself in the sequence diagram. If you can see that "handshake capture" really means "only (1) and (2) are needed," you’ve succeeded.

3-3. Dissecting the Cracking Command — Output Example

A reading exercise without equipment. The below are output examples (no wireless measurement possible).

sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
aircrack-ng -w wordlist.txt capture-01.cap

                               Aircrack-ng 1.7
      [00:00:12] 843210/14344392 keys tested (68901.23 k/s)
      KEY FOUND! [ Summer2026! ]
      Master Key     : 3F 8A ... (PMK)
      Transient Key  : 11 9C ... (PTK)

How to read it: you must be able to interpret the numbers on screen — 840k keys tested at 69k per second, and the found key is Summer2026!, a season+year password (note it’s the same pattern as Step 165’s spray candidates). And the result prints the PMK and PTK — the very values you drew in 3-2.

3-4. (Only If You Have the Equipment) Practicing with My Own Router

Only if you have a monitor-mode-capable adapter (the Alfa AWUS036 family, etc.) and the condition of my router + my devices is met:

Switch to monitor mode with sudo airmon-ng start wlan0
Check the nearby AP list with sudo airodump-ng wlan0mon (receiving only, up to here)
Fix on my AP’s channel, reconnect my phone, and confirm WPA handshake appears on screen
Run aircrack-ng -w only against my AP, deliberately set to a weak password that’s in the wordlist
When done, immediately restore a strong password and return with airmon-ng stop

⚠️ Nearby APs being visible in the list and attacking them are completely different things. Receiving is the equipment’s natural behavior, but the moment you send deauthentication packets at someone else’s AP, it’s illegal.

3-5. Defense Recap — My Router Checklist

Now that you know the attack structure, the defense is clear.

Make the password long and unique — the only wall against offline cracking. No dictionary words + season/year patterns
Switch to WPA3 (or WPA2/WPA3 mixed) — if the router supports it
Disable WPS — closes a separate backdoor of PIN brute force
Separate a guest network — isolate visitors and IoT devices from the main network
Change the router admin page password — it’s often still the factory default

4. Missions & Exercises

Mission — A Handshake Structure Document and a Defense Checklist

Close the book and draw the 4-way handshake sequence, then fill in three columns per message: value carried, ingredients needed, eavesdropper’s harvest
Rewrite 2-3’s five cracking steps in your own words — be sure to include "why verification is possible with no server"
Summarize the difference between the PMKID attack and handshake capture in two lines
Actually inspect my home router with 3-5’s checklist and record the results (if you change the password, record only that fact — never write the password itself)

Exercises

Exercise 1. In WPA2, explain through the MIC’s role why cracking is possible even though the password never rides in a packet.

Exercise 2. Give two reasons offline cracking is more dangerous than Step 122’s online brute force.

Exercise 3. State in one sentence the principle by which WPA3-SAE makes capture-based offline cracking impossible.

Exercise 4. Explain why the advice "a Wi-Fi password must be long and unique" follows directly from the handshake structure.

5. Model Answers & Completion Criteria

Mission Model Answer

Example of the cracking procedure in one’s own words:

The eavesdropper obtains the ANonce, SNonce, both MACs, and the MIC from the handshake. They make a candidate PMK from a password candidate, make a candidate PTK with the obtained material, and recompute the MIC. If this MIC equals the eavesdropped MIC, the candidate is the answer — verification is possible without a server because the packet itself contains the "answer key": the MIC.

How to verify: ① Does the sequence diagram have all three columns (value, ingredients, harvest)? ② Did you discover "material completes at message (2)"? ③ Does your PMKID explanation include "no need to wait for a connection; one AP response secures the material"? ④ Did your router inspection check WPS and the admin password too — changing only the Wi-Fi password and stopping is half the job?

Exercise Answers

Answer 1. The password itself never rides, but the MIC — which can only be made from the password (→PMK→PTK) — does. The eavesdropper has all the other ingredients (nonces, MACs), so they can recompute the MIC while varying only the password candidate and compare. The MIC is itself "the grading key for the password exam."

Answer 2. First, there’s no rate limiting and no lockout — with no server, you substitute infinitely, as much as your GPU allows. Second, no trace remains with the target — capturing is mere reception and cracking happens on the attacker’s computer, so the victim has no way to know.

Answer 3. SAE doesn’t derive a fixed key directly from the password but agrees on a fresh key each session, so eavesdropped packets contain no "answer key (like a MIC)" against which candidates can be graded.

Answer 4. Whether cracking after a handshake capture succeeds is decided solely by "is the password in the candidate list?" The cryptography doesn’t fall — human password habits fall — so a long, unique password is effectively the only user defense in this structure.

Completion Criteria Checklist

[ ] I can draw the 4-way handshake’s four messages without the book
[ ] I can explain the PMK→PTK→MIC derivation structure
[ ] I can state the causality of capture → offline cracking
[ ] I can explain the PMKID attack’s difference
[ ] I can state both WPA3-SAE’s improvements and its limits
[ ] I inspected my router against the checklist
[ ] I confirmed that others’ APs can never be a target

6. Common Pitfalls & Fixes

Wall 1. The interface doesn’t appear in airmon-ng start wlan0

Symptom: the list is empty or you get a no such device-type message.
Cause: built-in wireless cards often don’t support monitor mode — especially laptop internal cards.
Fix: you need a USB adapter that officially supports monitor mode, like the Alfa AWUS036 family. Without equipment, completing this chapter as concept review is fine — that’s the normal path.

Wall 2. WPA handshake never appears in airodump

Symptom: you started the capture but no handshake indication.
Cause: a handshake occurs only at the moment of connection. If only already-connected devices exist, nothing gets caught.
Fix: power-cycle your device to reconnect it. (In the field, aireplay-ng deauthentication forces reconnection, but that’s packet injection — only on your own equipment.) Or recall 2-4: the PMKID approach skips the connection wait entirely.

Wall 3. I captured but aircrack finds nothing

Symptom: millions tried, then KEY NOT FOUND.
Cause: the password isn’t in the wordlist. Cracking is a battle of dictionaries.
Fix: that’s normal — that is the defense. Think in reverse: if your password had been in rockyou, it would have come out in 12 seconds. Connect this experience directly to the 3-5 inspection.

Wall 4. WPA2 and WPA3 are mixed and I can’t tell what’s what

Symptom: the router settings say "WPA2/WPA3 mixed."
Cause: a transition mode for compatibility with older devices.
Fix: mixed mode is convenient but partially inherits WPA2’s weakness (offline-cracking feasibility). Once all your devices support WPA3, switching to WPA3-only is the goal.

Wall 5. I feel like "testing my skills" on the neighbor’s Wi-Fi

Symptom: the neighbor’s AP visible in airodump stimulates your curiosity.
Cause: a common impulse the moment the tool is in your hands.
Fix: absolutely not. Deauthentication or cracking attempts against others’ APs are crimes under radio-wave and telecommunications law, and wireless leaves physical clues even in reception traces. Skill testing is amply covered by my own router and CTF wireless challenges.

7. Summary

Today’s Concepts

Concept	One-line explanation
PMK	The master key pre-made from password+SSID — the root
PTK	The actual encryption key made per session from PMK+nonces+MACs
MIC	Proof of "do you know the PTK" — the eavesdropper’s grading key
4-way handshake	The four key-agreement messages at connection — (1) and (2) alone complete the cracking material
PMKID attack	Secures material with one AP response — skips the connection wait
SAE (WPA3)	Fresh key agreement every session — capture substitution impossible, forward secrecy
WPS	PIN-based easy connection — a separate backdoor to turn off

Today’s Commands

Command	What it does
`sudo airmon-ng start wlan0`	Switch to monitor mode
`sudo airodump-ng wlan0mon`	Collect nearby APs/clients
`airodump-ng -c channel --bssid MAC -w file`	Fixed-channel capture of the target
`aircrack-ng -w wordlist capture.cap`	Offline substitution
(Defense) router settings	Switch to WPA3, turn off WPS, change the admin password

An Instinct More Important Than Commands

Reduce today’s structure to one sentence: "The design that never sends the password ended up betting everything on that one password." The password not riding in packets doesn’t mean safety — it means the verification material (MIC) floats in the air, and the only unknown in that material is the password.

Knowing this structure, security news reads differently. A "WPA2 cracked" article doesn’t mean the cryptography broke — it means someone’s password was in a dictionary. A "WPA3 adoption" article means the grading key itself was removed. And there’s exactly one thing to do right now — check whether your router’s password has a shape that’s in a dictionary.

Once every box is checked, Step 166 is complete. Click the checkbox in the sidebar to save your progress.