Download Wi-Fi 4-Way Handshake Subtitles for Better Understanding

now to continue from my previous video where I showed the difference between passphrase and appreciate key I'm going to go through the full way handshake process that takes place when you join a wireless network okay now to get started I'm going to do a cup of packet captures firstly over the phone joining the network and also the Linux laptop joining just so I've got a couple of different types of client and I'm going to do the packet capture with the macbook here so we capture the four-way handshakes so for join phone up it'll join the network just capture the for a handshake and same for the laptop you'll join I think it's around to it it'll join hey there yeah it's now that's four-way handshake okay so those two devices on the network I'll just stop the capture now I'll have a look at that capture and go through step by step what it's actually doing in the 4-way handshake okay now but that packet capture open in Wireshark here and I've just filtered it just to show the four-way handshake from the phone now as I said in the previous video the pre shared key is not what encrypts the traffic the traffic encryption keys are made during this process and to do that there's a few variables involved there's the preciate key is one of the inputs to it the MAC address of the Authenticator which is the a P so the MAC address of the AP and the MAC address of the client there's also a couple of one-time values called monsters okay so the AP has a month which is just a random value the lonely used is one time and the wireless client will also have a one-time number so if I have a look at the capture we can start to see the process first of all the Aruba is is the AP and that I saw whistle is the phone okay so the first thing it does you can see it sends out its nuts now that's that one-time value that it comes up with so it sends that out to the wireless client now at that point when the client receives that first frame it actually has everything it needs to make that function for the traffic keys it knows the MAC address of the AP know it's mac-address it knows the one time value from the AP and it's made it's one time value so it's already got that and it knows the pre-shared key so there are five inputs okay so it gets that and the second frame now you'll see that nuts is is different because this is now the clients nuts you've got the nuts from the AP that random value and you've got the clients random value so at frame two when the client sends back to the AP it gives it its one-time number so now the AP the Authenticator has all the the variables that I just just mentioned there the appreciate key that has started with the MAC addresses of the the AP and the station and now it knows it already knew it's nuts and now it knows the station's nuts so it can make the traffic keys once we have them we have the keys to do unicast traffic the next the next frame here is to do with the group keys now group keys are for things like multicast and broadcast things where all clients would have to receive that so they would have the same key for all that whereas if it's unicast it'll use just a key particular to that client so the next client can't actually snoop that even though they sort of can't if they get tricky anyway to put these group keys onto the client the data can be encrypted using the pairwise transit keys that we just set up a second ago see once the pairwise traffic keys have been set up with the first two frames it can now encrypt the group key in the third frame so it doesn't have to be as as out in the open so right there at this WPA key data that's for the group keys that are going to be installed and it's encrypted with the pairwise transient key now if you've put a wrong password in it will fail at this point because it won't have established the pairwise keys properly so what I'll do is I'll do another packet capture now when the passphrase apreciate key is wrong and just see how far it gets compared to a working one like this actually before I go into showing what a wrong password looks like I'll just show you side-by-side the phone and a laptop that I captured just to point out that this Nance that I that I spoke about which is that one time number isn't is indeed different on both of the captures okay so when the AP sent it out for this client it had that value when its ended out for this client had had that value okay and of course the clients came up with their own separate values okay I did another packet capture but this time I put the wrong password in on the phone just to show you what happens and as you can see from the cap so it doesn't get passed message two now the reason is as I said a minute ago it uses those first two frames to set up the pairwise key so if it doesn't succeed in that it's not going to be able to proceed to the group key or any further at all but one thing I want to show you is that nuts the one time number that I spoke about when the AP sends it out every time it it doesn't it sends it out differently okay it has a new number the client though doesn't it's nuts it's the same through all its efforts because it's still thinking that it's trying what it believes is right but if not it's wrong okay so it fails there that's when you'll get on your phone or whatever it'll say now try and put the password in again so if you ever doing packet captures and you see the full way handshake fail after two messages odds are pretty good that you've got the wrong password now as I've shown in a previous video if you capture the four-way handshake and you know the pre shared key you can decrypt the traffic in Wireshark okay because you've got all the information that it had when it made the pairwise transient keys so you can decrypt it too now as I said you have to capture that four-way handshake though it's no good just knowing the ppreciate key and thinking you can decrypt WPA traffic you need the four-way handshake because as I've just shown that's how the actual traffic encryption keys are made so anyway have fun with that and I hope that helps you out [Music]