4-Way Handshake
Definition
The WPA/WPA2 key-establishment exchange between client and AP. Captured frames let an offline dictionary attack recover a weak PSK. WPA3 replaces this with SAE (Dragonfly), which is resistant to offline guessing.
- Protocol
- WPA/WPA2 key establishment exchange
- Vulnerability
- Captured frames enable offline dictionary attack on weak PSK
- Replacement
- WPA3 uses SAE (Dragonfly)
Common questions
Why is capturing the handshake alone enough to attempt a password attack later?+
The handshake frames contain enough cryptographic material to test candidate passwords against without any further contact with the network, letting an attacker run high-speed guesses on separate hardware at their own pace.
How does WPA3's SAE prevent this kind of offline attack?+
SAE requires an active interaction with the access point for each password guess and does not expose material suited to fast offline testing, unlike the WPA/WPA2 handshake, which makes large-scale offline guessing infeasible.
Related terms
- BSSID / ESSID
- BSSID is the MAC address of the access point (or virtual AP). ESSID is the human-readable network name broadcast in beacons. Multiple...
- Evil Twin
- A rogue AP broadcasting the same ESSID as a legitimate network at a stronger signal, so clients with cached profiles auto-associate. Often...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- KRACK
- Key Reinstallation Attack, CVE-2017-13077, disclosed by Mathy Vanhoef in 2017. By replaying message 3 of the 4-way handshake, the client is forced...
- PMKID Attack
- A 2018 technique by Jens Steube (hashcat author) that derives the Pairwise Master Key Identifier from a single EAPOL frame the AP...