HPE7-A01 · Question #77
Drag and Drop Question List the WPA 4-Way Handshake functions in the correct order. Answer:
The correct answer is Proves knowledge of the PMK; Exchanges messages for generating PTK; Distributes an encrypted GTK to the client; Sets first initialization vector (IV). WPA 4-Way Handshake - Explained The 4-Way Handshake authenticates both parties and establishes session keys between an Access Point (AP) and a client (supplicant). It builds cryptographically - each step depends on the previous one. --- Step 1: Proves knowledge of the PMK What ha
Question
Drag and Drop Question List the WPA 4-Way Handshake functions in the correct order. Answer:
Exhibit
Answer Area
Drag items
Correct arrangement
- Proves knowledge of the PMK
- Exchanges messages for generating PTK
- Distributes an encrypted GTK to the client
- Sets first initialization vector (IV)
Explanation
WPA 4-Way Handshake - Explained
The 4-Way Handshake authenticates both parties and establishes session keys between an Access Point (AP) and a client (supplicant). It builds cryptographically - each step depends on the previous one.
Step 1: Proves knowledge of the PMK
What happens: The AP sends a random nonce (ANonce) to the client. The client responds with its own nonce (SNonce) and a Message Integrity Code (MIC). The MIC is computed using a key derived from the PMK - so if the MIC is valid, both parties implicitly prove they hold the same PMK without ever transmitting it.
Why first: Nothing else can proceed without mutual authentication. The PMK (Pre-Shared Key or derived via 802.1X) is the shared secret that anchors all trust. You must establish this before generating any session keys.
Step 2: Exchanges messages for generating PTK
What happens: Using the ANonce, SNonce, both MAC addresses, and the PMK, both sides independently compute the PTK (Pairwise Transient Key) via a pseudorandom function. No additional transmission is needed - each side derives it locally.
Why second: The PTK requires both nonces, so it can only be derived after both have been exchanged in Step 1. The PTK is the actual encryption key used for unicast traffic.
Step 3: Distributes an encrypted GTK to the client
What happens: The AP encrypts the GTK (Group Temporal Key) using the PTK and sends it to the client, along with another MIC for integrity verification.
Why third: The GTK protects broadcast/multicast traffic and must be delivered after the PTK exists - because the PTK is what encrypts the GTK in transit. Without Step 2, this transmission would be insecure.
Step 4: Sets first initialization vector (IV)
What happens: The client sends an ACK confirming receipt of the GTK. Both sides install their keys and reset/set the first IV, marking the start of encrypted communication.
Why last: The IV governs the counter for encrypted frames. It only makes sense to initialize it once all keys are in place and confirmed. Setting it earlier would be premature.
Common Mistakes
| Mistake | Why it's wrong |
|---|---|
| Putting GTK before PTK | GTK is encrypted by the PTK - it physically cannot come first |
| Thinking the client initiates the handshake | The AP always sends the first message (ANonce) |
| Conflating PMK and PTK | PMK is long-lived and static; PTK is session-specific and derived per-connection |
| Placing IV setup before key confirmation | IV tracks encrypted frame order - you can't start counting before keys are agreed upon |
Memory aid: Proof → PTK → GTK → IV - "People Prefer Good Initialization"
Topics
Community Discussion
No community discussion yet for this question.