How is wpa2 authentication structured

Question

I would like to understand the cryptography behind Wpa2. As far as I know, there are 4 messages on the 4-way handshake and three of them are values concatenated with hashes. First, I am trying to understand how the PTK is generated. I believe that it is:

H(an||stn||amac||stmac||PSK) 

Where "h" function is sha1, "an" is the ap nonce, "stn" is the client nonce, "amac" is ap's mac address, "stmac" is client's Mac address and PSK is the shared key, But I might be totally wrong. Second, the second message on the handshake is

Stn || H(an || KCK) 

Right? My question is if it is the way I wrote or it is different.

Thanks in advance

Answer 1

In pairwise key hierarchy there are two root keys: pre-shared key (PSK) and Authentication, Authorization, and Accounting Key (AAAK). From these two keys pairwise master key (PMK) is derived. In the case of PSK, PMK is equal to PSK. In other case, PMK is obtained by taking the first 256 bits of AAAK. Now, to the question about generating pairwise transient key (PTK).

PTK is generated from PMK by using pseudorandom function (PRF) which is based on HMAC-SHA-1. The formula will be: PTK=PRF(PMK, X, an||stn||amac||stmac). Where X is the parameter indicating the length of PTK. Note that, in CCMP X=384 bits, whereas in TKIP X=512 bits.

Unfortunately, I'll not be able to answer your second question. If nobody else will reply, I'll do it later. The good reference is this document IEEE802.11i-2004