Hello and welcome to this video titled WPA Transient and Temporal Key
Generation. So once again, before I go into the mechanics of how these
various keys are derived, I'd just like to start by giving you the high
level critical information.
So once again, if you're just simply watching this course because you
want to pass some simple, you know, wireless exam, you might not need
the level of detail I'm about to go into here.
So what's the takeaway up front?
The takeaway is this.
Before the four-way EAP Overland exchange happens, the pairwise master
key has already been developed.
Now we're strictly focusing on WPA3 SAE here, as well as WPA2 personal.
In both cases, the pairwise master key has to be derived before even the
first message of the EAP Overland key exchange happens.
Then the first message that happens is that the access point will send
the first EAP Overland key message to the client.
Once the client gets that, the client has everything it needs to create
its pairwise transient key.
From the pairwise transient key, it can then divide that up into three
pieces, the temporal key, the key encryption key, and the key confirmation
key. The client has everything it needs just after receiving the first
message. After the client sends EAP Overland message number two to the
access point, the access point has everything it needs to create all of
those keys. That's pretty much it from a high level.
Now let's go into the actual mechanics of how this works at a lower level
so you can understand what's going on under the hood.
Okay, so here we start out where due to the SAE exchange, both the station
and the access point have derived their shared pairwise master key for
this session, just for these two people.
So they say, okay, well, the next thing we need to do in the chain of
events is we need to derive our pairwise transient key.
So the first thing that's going to happen is that access point is going
to send an EAP Overland key message, the very first one, so we call this
message one or M one.
And in that EAP Overland key message, it's going to send something called
an A-nots. Now in the next slide, I'm going to talk about what nounces
are, but that's going to be a critical thing that we're going to see in
just a moment. The client is going to send message number two upstream
to the access point, which is going to have its own net knots called the
S-nots. Nose A-nots here is for authenticator knots.
S-nots is for supplicant knots, because even when you're doing personal,
the station is still considered a supplicant and the access point is still
considered the authenticator, even if you're not doing 802.1x.
And then we have two other messages are exchanged to complete our four
way exchange. Okay, so if you've never heard this term, knots before,
what is that? So a nounce simply means a number used once, number used
once. And we've seen that they're exchanged in the first two EAP Overland
key messages. And they're freshly created every time a client associates
or reassociates with an access point.
And this is a key point here because in order to derive a fresh set of
keys that are unique from any previous sessions you may have had, we have
to have a fresh set of nounces, as well as a fresh pairwise master key
as well. So this allows us to derive fresh pairwise keys.
All right, so nounces these random numbers, numbers used once, are used
as one of several inputs into a key derivation function, a KDF.
That's the formula to come up with various keys.
We'll show you how that works, along with MAC addresses and the pairwise
master key. Now, if you're like me, you're sort of wondering, well, how
do they come up with these random numbers called a number used once?
How does the supplicant come up with that?
How does the access point come up with it?
Well, so nounces are produced by a cryptographically secure pseudo random
number generator, otherwise known as CSPRNG, C spring.
And what you're seeing right here is an example of on a Linux based client,
for example, like on a MacBook that's a Linux based, you'll actually see
deep in the guts of it in the slash dev slash you slash dev, there is
a you random folder.
And so you random is actually the cryptographically secure pseudo random
number number generator that a Linux based system will use to create random
numbers, for example, for this purpose to create its its s knots.
And access points will also have their own C springs that they can use
to create random numbers.
Okay, so let's go back to this.
So the access point has now sent its Epos over land message number one,
which contains a random A knots, like in this case, 12345.
We also have the access points MAC address.
So now this client here has all of this information.
Okay, so it knows the pairwise master key, it knows the MAC address of
itself. Obviously the MAC address of the access point, it knows the access
points, knots, the A knots, it also knows the S knots now it hasn't sent
the S knots yet, but it's already computed it.
We can see that right here, 33456.
So with all that information, the client says I can now put that into
a formula and compute my pairwise master key.
So let's look and see how that actually happens.
Now right here, this is WPA2, this is not WPA3, but the process is very
similar. I'm going to show you how WPA2 does it.
And then I'm going to compare that with WPA3.
And remember, this is the personal version here.
Okay, actually, no, this is enterprise as well, both personal and enterprise.
You have to do the four way handshake and the derivation of the pairwise
transient key and everything is the same, whether it's enterprise or personal.
Okay, so the client receives EPUR land message number one, it's got all
that stuff. So it's going to invoke something called a pseudo random function
512, pseudo random function 512.
What does that mean?
So the idea here is we want to create a pairwise transient key.
And according to the specifications, the pairwise transient key has to
be 512 bits in length.
That's why we have PRF 512.
So this function here is going to take several pieces of information as
input. And that's what this is showing you right here.
So let's look at each one of these things.
So the pseudo random function is going to take whatever the pairwise master
key is. So that's right here.
So it's going to take that as input.
It's going to take this string called pairwise key expansion is actually
going to be that text string that's going to be in there.
And then it's going to look at the MAC address of the client, the MAC
address of the access point, and it's going to say which one is smaller.
I'll put that next is going to line all these values up left to right.
So the minimum of the MAC addresses.
And then right after that is going to have the bigger MAC address of those
two. Then it's going to take a look at the a nonce and the S nonce and
say which one of those is smaller.
I'll put that one in.
And then I'll put in the larger of the noncees.
And then lastly, it'll put in a counter.
So just imagine a long string of bits now 1010110 is created based on
all of these values here.
Now what do we do with that?
So now we plug that into.
So here's an example, right?
XX Y Y that's our PMK.
Here's the string pairwise key expansion.
Here's the value.
So here is the smallest MAC address.
So between the client's MAC address and the access point, the client had
the smaller MAC.
So that came first.
Access points, MAC came second because it was bigger.
And then the access points, knots was smaller than the clients or the
supplements, not.
So the access points, knots went in, then the supplicants, knots followed
by the counter. And all that is fed into an H MAC Shaw one function.
Now keep in mind, this is WPA2.
So the result of an H MAC Shaw one function is to create a number that
is 160 bits long.
Well, this is kind of problematic, isn't it?
Because we need a pairwise transient key that's 512 bits long, and this
isn't long enough.
So guess what? We're going to take that count.
We're going to leave all these inputs the same except for the counter.
And we're going to increment that counter from one to two.
And now we're going to run all that through the H MAC Shaw one again,
and we come up with a different value.
Still not quite 512 yet.
So we increment the counter again, run it through the formula again, come
up with another 160 bit value, increment the counter a fourth time.
And now after four iterations of this, if we add all those together, that
gives us 640 bits worth of material.
So we simply chop off the last 128 bits, trim that, which leaves us ta
-da our 512 bit pairwise transient key.
So this all happened that fast the moment that the client received the
EPUVRA LAN message one.
Okay, so this is just we're going to go back to how WP3 does it in just
a moment, but just as a recap here.
So we know that the pairwise master key originates from either the pre
shared key or in WPA3 SAE results.
It's derived through many different formulas using like hunting and pecking
hash to element, using a password element and so on and so forth.
Or if you're doing 802.1x, then the authentication server simply sends
you this big, massively long master session key and you just take the
first half of that and that's your pairwise master key.
Either way, that's already done.
Then we get message number one from the access point to the client.
And now the client has everything it needs to create its pairwise transient
key. Then message number two goes from the client to the access point.
And we'll see with that, the access point has everything it needs to derive
the exact same pairwise transient key.
So with a one two exchange, both sides have derived the pairwise transient
keys. Now we'll talk about what the mick is and everything here in just
a second. And then in message number three, from the access point to the
client, that's where the access point says, hey, client, by the way, I've
had this group tran, group temporal key hanging around here that I used
to encrypt all my broadcast and multi-cast messages.
Let me send that to you as well so that you can have that.
And then lastly, in message number four, from the client to the access
point, the client says, we're good, we're good to go.
Let's start encrypting some actual data here so I can get to my websites
and things. Okay, so here, this slide is going to look very much like
the previous slide, but notice at the top, it says wp-8-3.
So now we're back to wp-3.
So same thing happens in epos overland, message number one.
Okay, the client ends up knowing everything.
Now notice, here, he's going to invoke a prf-256 function.
Remember, let's go back here wp-2.
And wp-2 is a prf-512 function.
So the function's a little bit different with wp-3.
You might see a way a second.
Aren't we supposed to come up with a 512-bit pairwise transient key?
Yes, we are, but look, this is actually more efficient.
So we're going to take the exact same input.
So this is no different than wp-2.
The exact same inputs in the exact same order.
So there they are.
But now we're running them through an h -mac 256 algorithm, a hashing algorithm.
And guess what? When it hashed all this stuff, the result is not a 160
-bit thing like wp-2 had.
It's a 256-bit number.
So he only has to do it twice.
So he increments the counter a second time, runs it through, and now he's
got everything he needs.
Hey, I don't know why that 4 is in there.
There we go. Okay, so he's incremented the counter twice from 0x01 to
0x02. That's now created two hash digest outputs, which are both 256-bits
long. All he has to do is add those two things together and voila.
He has got his pairwise transient key.
So you can see the mechanics of this for wp-3 are virtually the same as
for wp-2. The only difference is the hashing algorithm produces larger
output. So it doesn't have to run through as many iterations as wp-2.
Okay, so we've now got the pairwise transient key.
So here we are. Okay, so we're back to the point where the client has
received message number 1.
And whether he was doing wp-2 or wp-3, it doesn't really matter.
At the end of the game, after he's received message number 1, he's derived
his pairwise transient key 512-bits.
So before he even creates message number 2 to send it to the access point,
he's going to do something first.
After the 512-bit pairwise transient key is developed, he is going to
divide that into three, actually four pieces.
The first piece, like right here in red, he's going to say, I'm going
to now call that my key confirmation key.
What does he do with that?
What's the purpose of that?
Well, now that he's got the key confirmation key, he can send message
number 2 to the access point.
What's different between message 2 and message 1?
Well, a couple of things.
Number 1, message 1 contained the A-nots.
The access points number used once, the A-nots.
Here in message number 2, he's sending his own nots, the S-nots, from
the client. And he's taking the entire message, and then he's putting
at the end of it a message integrity code, a message integrity code, which
is basically a way of checking the integrity of the message.
He says, look, I'm going to take all the bits of my message number 2,
run them through this mick formula, which is going to add the key confirmation
key, and using the bits of the message plus the key confirmation key.
And remember, where this key confirmation key come from?
It's part of the pairwise transient key.
So by using the message, the key confirmation key, I'm going to compute
a message integrity code and put that at the end of the message.
Now, why does he do that?
Well, this is for the benefit of the access point.
You see, once the access point receives message number 2, now he has all
the same information that the client had at the beginning, and the access
point can create the same pairwise transient key, this big long number
here. And guess what?
He has the added benefit of once he creates the pairwise transient key,
he's also going to have the exact same key confirmation key.
So now he can take a look at this message number 2, and he can say, well,
I'm going to run it through the exact same formula.
I'm going to use the key confirmation key I came up with.
And if the mick I come up with is exactly the same as the mick in message
number 2, I have my assurance that the client has the exact same PTK as
me. So without exchanging the PTK over the wire, or I should say, over
the wireless, now the access point can validate that the client has the
same PTK. However, the client hasn't done that yet, right?
The client, even though he knows he has a PTK, the client does not have
yet the warm fuzzies that the access point derive the same number.
So we're going to see here in message number 3, from the access point,
the access point is also going to apply a mick.
And that's how the client's going to know, ah, good.
You must have the same key confirmation key as me.
We're good. So we're going to see that here just coming up in a second.
So now the second part of the pairwise transient key is used as the key
encryption key. So what's that used for?
Okay. So now the access point is going to say, hey, I need to send message
number 3 back to the client, back to the client.
And in message number 3, I'm going to give him the group temporal key.
You know, the key I'm going to use to encrypt broadcast and multicast
messages. And obviously he needs to have that so he can decrypt any broadcast
or multicast messages that I send.
And he says, I need to send that group temporal key in a secure way to
the client. Hmm.
How do I do that?
Well, why don't I take the key encryption key and encrypt it?
So that's what the key encryption key is used for.
Its only purpose is for the access point to encrypt the group temporal
key in this message number 3, and so that the client can decrypt it.
And notice that the access point is also using that key confirmation key
to come up with the mick value of this message.
And then lastly, we have message number 4, where the client basically
says, we're good.
We've got all the same values.
And so the last piece of this here in green, that is our temporal key.
That's the actual key now that the access point and the client are going
to use to encrypt and decrypt our unicast data, you know, the vast majority
of data that you're sending to and from the access point.
And you might be thinking, well, what's that last little piece that 987
ABC? What's that little piece going to be used for?
So that's the key to the machine material for optional mick keys if you're
using T-cap, which in WPA3, you wouldn't be doing that, but in WPA2, you
might if you're trying to be backwards compatible with older WPA devices.
So that is the mechanics of how all those keys are developed and exchanged.
Thank you so much for watching this video, and I hope it was helpful for