On: Cracking Linksys “Encryption”

[smtddr]

    smtddr@POKEMONGYM:~$ wpa_passphrase My_AP_SSID mysup3rs3cr3tp@ssw0rd
    network={
    	ssid="My_AP_SSID"
	#psk="mysup3rs3cr3tp@ssw0rd"
	psk=a6356f17ad3bb0f18385a0faa57d10c20352b977411e636c5466f933bb415fdd
    }
    smtddr@POKEMONGYM:~$

Note that the #psk line with the plain password is commented out, so it could be removed. How exactly this works though; why can that hash be used to login.... I have no idea whatsoever. Maybe it's not a hash. I'd love for someone to explain.

[dlgeek → smtddr]

First let me explain the relationship between the first and second values.

For authentcation, passphrases are used because they're a lot easier for humans to remember than 256 bit hex strings. The WPA2 standard (IEEE 802.11i) defines the passphrase to PSK derivation as "PSK = PBKDF2(PassPhrase, ssid, ssidLength, 4096, 256)" (PBKDF2 is a hashing-based key derivation function, in this case using SHA1).

So, this takes us from a password to a key. Now how do we auth to the router?

In WPA2, there's a master-key (known as the "pairwise master key" or PMK) which is known by both the client and the access point. This key (the PMK) is then used in a 4-way hand-shake and key negotiation that allows each party to establish that the other has knowledge of the key. This key is either handled via a complex authorization mechanism like radius (WPA-EPA) or is simply shared between all the parties (WPA-PSK). In this case, the pre-shared key ("PSK") that we derived above is used directly as the PMK to complete the 4-way handshake.

[raverbashing → smtddr]

WPA uses PBKDF2 so that's probably how it gets to that value