| PMK (Pre-Shared Key mode) | 256 bits | PMK = PBKDF2(HMAC-SHA1, Passphrase, SSID, Iterations=4096, dkLen=32)
Note: SSID is the salt; 4096 PBKDF2 iterations makes offline attack slow but not infeasible
For AES-256: dkLen=32 bytes = 256 bits
Derivation takes ~100ms on modern CPU = brute force protection | Master secret for PSK auth. Input to 4-way handshake. | IEEE 802.11i, RFC 2898 PBKDF2 |
| PMK (Enterprise/EAP mode) | 256 bits | PMK = MSK[0:32] (first 32 bytes of MSK)
MSK = Master Session Key derived by EAP method during 802.1X auth
For GCMP-256/192-bit: PMK-256 = first 32B of MSK
For WPA3-Ent 192-bit: PMK from HMAC-SHA-384 EAP method | Same role as PSK-PMK but derived from EAP/RADIUS auth | IEEE 802.1X, RFC 3748 |
| PMK (SAE/WPA3 mode) | 256 bits | keyseed = H(<0>^n, k) where k = shared secret from SAE Commit exchange (derived via PWE)
KCK||PMK = KDF-512(keyseed, 'SAE KCK and PMK', context) - PMK = second 256 bits
Note: With H2E: PMK derived from hash-to-element (constant time, no timing oracle)
Fresh PMK per session = perfect forward secrecy | WPA3-Personal PMK. No PMKID offline attack possible. | IEEE 802.11-2020 §12.4 |
| PMKID | 128 bits (16 bytes) | PMKID = HMAC-SHA1-128(PMK, 'PMK Name' || AP_MAC_BSSID || STA_MAC)
Where 'PMK Name' is literal ASCII string (8 bytes)
Formatted as: AA:BB:CC:DD:EE:FF:GG:HH:II:JJ:KK:LL:MM:NN:OO:PP
WPA2-PSK: PMKID extractable from Assoc Req RSN IE without capturing 4-way handshake (hashcat mode 22000)
WPA3-SAE: PMKID computed differently and not useful for offline attack | Carried in RSN IE for PMKSA cache lookup. WPA2 PSK: offline attack vector. | IEEE 802.11-2020 §12.7.1.3 |
| PTK (Pairwise Transient Key) | 384 bits (CCMP-128) or 704 bits (192-bit suite) | PTK = PRF-X(PMK, 'Pairwise key expansion', Min(AA,SPA)||Max(AA,SPA)||Min(ANonce,SNonce)||Max(ANonce,SNonce))
Where AA=AP MAC, SPA=STA MAC, sorted so both sides compute same value
PRF-384 for CCMP-128: uses HMAC-SHA1 (deprecated but still common)
PRF-512 for GCMP-256: uses HMAC-SHA256
Note: Min/Max sorting ensures key independence regardless of who sends first | Session key derived per-association. Contains KCK+KEK+TK. | IEEE 802.11-2020 §12.7.1.2 |
| KCK (Key Confirmation Key) | 128 bits (CCMP) or 192 bits (GCMP-256) | KCK = PTK[0:KCK_len]
For CCMP-128: KCK = PTK bits 0-127 (16 bytes)
For GCMP-256 (192-bit mode): KCK = PTK bits 0-191 (24 bytes)
Algorithm: HMAC-SHA1-128 (CCMP) or HMAC-SHA256-192 (GCMP-256)
Usage: Compute and verify MIC in EAPOL-Key messages 2,3,4
KRACK: If KCK is wrong (PSK mismatch), MIC fails in Msg 2 -> AP retransmits Msg 1 | Authenticates EAPOL-Key messages. Wrong KCK = no 4-way HS completion. | IEEE 802.11-2020 §12.7.2 |
| KEK (Key Encryption Key) | 128 bits (CCMP) or 256 bits (GCMP-256) | KEK = PTK[KCK_len : KCK_len+KEK_len]
For CCMP-128: KEK = PTK bits 128-255 (16 bytes)
For GCMP-256: KEK = PTK bits 192-447 (32 bytes)
Algorithm: AES-KeyWrap (RFC 3394) - KEK wraps GTK and IGTK
In EAPOL Msg 3: Key Data = AES-KeyWrap(KEK, GTK_KDE || IGTK_KDE || RSN_IE) | Encrypts GTK/IGTK delivery in EAPOL Msg 3. Confidential key distribution. | RFC 3394, IEEE 802.11-2020 §12.7.2 |
| TK (Temporal Key / Data Key) | 128 bits (CCMP-128) or 256 bits (GCMP-256) | TK = PTK[KCK_len+KEK_len : end]
For CCMP-128: TK = PTK bits 256-383 (16 bytes)
For GCMP-256: TK = PTK bits 448-703 (32 bytes)
Usage: AES key for CCMP/GCMP encryption of all unicast data frames
KRACK vulnerability: TK reinstallation with nonce=0 allows keystream recovery
TK changes only when new 4-way handshake runs or GTK rekey | Encrypts/decrypts unicast data. Core session encryption key. | IEEE 802.11-2020 §12.7.2 |
| GTK (Group Temporal Key) | 128 bits (CCMP) or 256 bits (GCMP-256) | GTK = PRF-X(GMK, 'Group key expansion', AA || GKNonce)
Where GMK = Group Master Key (AP generates randomly)
AA = AP BSSID, GKNonce = random 256-bit nonce
Delivered in EAPOL Msg 3 encrypted with KEK (AES-KeyWrap)
GTK rekey: triggered on STA departure (revocation) or dot11RSNAConfigGroupRekeyTime (default 3600s) | Encrypts broadcast/multicast data. All STAs in BSS share same GTK. | IEEE 802.11-2020 §12.7.4 |
| IGTK (Integrity Group Temporal Key) | 128 bits (BIP-CMAC-128) or 256 bits (BIP-GMAC-256) | IGTK = PRF-X(GMK, 'IGTK key expansion', AA || GKNonce)
Delivered in EAPOL Msg 3 alongside GTK
KeyID: 4 or 5 (IGTK uses keyslots 4-5, GTK uses 1-3)
Algorithm: BIP-CMAC-128 (CCMP suite) or BIP-GMAC-256 (WPA3-Ent 192-bit)
Protects: broadcast Deauth, Disassoc, Action frames (PMF 802.11w) | Protects broadcast management frames. Prevents rogue Deauth attacks. | IEEE 802.11w, IEEE 802.11-2020 §12.7.5 |
| PMK-R0 (Fast Transition) | 256 bits | PMK-R0 = KDF-SHA256(XXKey, 'FT-R0', SSIDlen||SSID||MDID||R0KHlen||R0KH-ID||S0KH-ID)
XXKey = PSK (personal) or MSK[32:64] (802.1X) - note: NOT the same bits as the plain PMK
Derived at initial FT association
Stored at R0KH (Root key holder - typically WLC)
R0KH-ID identifies the key holder domain
Never sent to APs - only PMK-R1 is pushed to individual APs | FT (802.11r) key hierarchy root. Enables fast roaming. | IEEE 802.11r, 802.11-2020 §12.11 |
| PMK-R1 (Fast Transition) | 256 bits | PMK-R1 = HMAC-SHA256(PMK-R0, 'FT-R1' || R1KH-ID || S1KH-ID)
R0KH pushes PMK-R1 to target AP (R1KH) over R0KH-R1KH interface
Allows target AP to derive PTK without STA re-running full EAP
FT over-Air: STA sends Reassoc with FT IEs; AP uses PMK-R1
FT over-DS: STA requests via current AP before moving; lower latency | Per-AP key derived from PMK-R0. Sent to target APs for fast roam. | IEEE 802.11r, 802.11-2020 §12.11 |
| rRK (Re-auth Root Key) | 704 bits | rRK = KDF(EMSK, 'EAP Re-authentication Root Key@<domain>' || length)
Where EMSK = Extended Master Session Key (from EAP method, 64B)
Stored only at ERP server and client
Used to derive rIK for re-auth integrity, rMSK for new PMK | ERP (RFC 6696) root key. Enables fast re-auth without full EAP. | RFC 6696 |
| rMSK (Re-auth MSK) | 64 bytes | rMSK = KDF(rRK, 'Re-authentication Master Session Key@<domain>' || seq_num || length)
rMSK -> PMK (first 32B) for new association after ERP re-auth
Seq_num prevents replay
ERP re-auth: 1 round-trip instead of full EAP (saves 200-400ms)
FILS uses rMSK as PMK input | New PMK for fast re-auth. Used by FILS to skip 4-way handshake. | RFC 6696, 802.11ai FILS |
| FILS-PTK | Variable | PTK = FILS-PRF(PMK=rMSK, 'FILS PTK' || ANonce || SNonce || AP_MAC || STA_MAC)
FILS keys: ICK || KEK || TK all derived in one KDF pass (ICK authenticates the FILS exchange)
FILS delivers GTK/IGTK + IP config in Auth Response Wrapped Data IE (encrypted with KEK)
No separate 4-way handshake needed
FILS reduces connection time from ~500ms to <100ms | FILS fast connection key. Derived inside Auth frame exchange. | 802.11ai FILS, 802.11-2020 §26 |