HPE6-A85 · Question #58
Drag and Drop Question List the WPA 4-Way Handshake functions in the correct order. Answer:
WPA 4-Way Handshake - Correct Order The Correct Sequence | # | Step | |---|------| | 1 | Exchanges messages for generating PTK | | 2 | Proves knowledge of the PMK | | 3 | Distributes an encrypted GTK to the client | | 4 | Sets first initialization vector (IV) | --- Background…
Question
Drag and Drop Question List the WPA 4-Way Handshake functions in the correct order. Answer:
Exhibit
Answer Area
Drag items
Explanation
WPA 4-Way Handshake - Correct Order
The Correct Sequence
| # | Step |
|---|---|
| 1 | Exchanges messages for generating PTK |
| 2 | Proves knowledge of the PMK |
| 3 | Distributes an encrypted GTK to the client |
| 4 | Sets first initialization vector (IV) |
Background
Before the handshake begins, both the AP and client already share a PMK (Pairwise Master Key) - derived from either PSK (passphrase) or 802.1X EAP authentication. The 4-Way Handshake's job is to use that PMK to generate fresh session keys without transmitting it on the wire.
Step-by-Step Breakdown
1. Exchanges messages for generating PTK
Why first: The AP sends its ANonce (Message 1) and the client replies with its SNonce (Message 2). Both sides then independently compute:
PTK = PRF(PMK + ANonce + SNonce + AP_MAC + Client_MAC)
This must happen first - everything else depends on the PTK existing.
2. Proves knowledge of the PMK
Why second: The SNonce reply (Message 2) includes a MIC (Message Integrity Code) computed using the PTK - which is only derivable if you know the PMK. The AP verifies this MIC to confirm the client knows the PMK without the PMK ever being sent. The AP's MIC in Message 3 proves the same in reverse.
This is the mutual authentication step.
3. Distributes an encrypted GTK to the client
Why third: Only after PTK is established and both parties are authenticated does the AP send the GTK (Group Temporal Key) in Message 3, encrypted using the fresh PTK. The GTK is used for multicast/broadcast traffic - it must be protected in transit, which requires the PTK to already exist.
4. Sets first initialization vector (IV)
Why last: Message 4 (client ACK) signals both sides to install the keys. Once installed, the IV is initialized to 0 (or 1 in some implementations), and encrypted data transmission can begin. Setting the IV last prevents replay attacks from pre-installation traffic.
Common Misconceptions
| Misconception | Reality |
|---|---|
| "PMK proof comes first" | You can't prove PMK knowledge until nonces are exchanged to derive the PTK (which contains the MIC) |
| "GTK is sent in plaintext" | GTK is always encrypted with the PTK - this is the whole point of establishing PTK first |
| "The handshake transmits the PMK" | Never - only nonces and MICs traverse the wire; the PMK is inferred |
| "IV is set before key installation" | The IV is initialized as part of key installation in the final acknowledgment phase |
Topics
Community Discussion
No community discussion yet for this question.