Understanding WPA2 authentication in details

Question

As far as I know, WPA2 authentication consists of a 4-way handshake. The first message is from the AP, containing the ANounce, a random number generated by the AP, The second message is from the client, containing the SNounce concatenated with a MIC of the ANounce, the third is from the AP containing the GTK concatenated with some MIC and the last is simply an ack.

In the case of PSK, PMK = PBKDF2(HMAC−SHA1, PSK, SSID, 4096, 256). So supposing I have psk = "personal-key" and ssid = "net-name", the function would be PBKDF2(HMAC−SHA1, "personal-key", "net-name", 4096, 256)

4 iterations of 4096 hmacsha1 xor chains concatenated to form 256b

I do not understand though how the PTK is generated. According to this question, PTK is generated from HMAC-SHA1 of length 512 of PMK as key and (ANounce || SNounce || AP MAC || Client MAC) as text, but how can it generate data of 512b length if SHA1 only outputs 160b? Isn't HMAC-SHA1 equal to SHA1(key XOR opad || SHA1(key XOR ipad || text))?

My second problem is how MICs are computed. I know that they use some message and a key. In WPA2 case, the key is the KCK, the first 128b of PTK, but what is the algorithim used in the computation?

And the third problem is how GTK generated and what is the message inside de MIC that is sent on the third message.

Answer 1

The following answers are taken directly from the 802.11 standard (2012 version).

1. The PTK is generated as follows: $$\mathrm{PTK} \gets \operatorname{\mathrm{PRF-X}(PMK, ``pairwise \ key \ expansion", \\ min(AA, SPA) || max(AA,SPA)|| \\ min(ANonce, SNonce) || max(ANonce, SNonce)) } $$ where $\mathrm{AA}$ and $\mathrm{SPA}$ are the MAC addresses of the Authenticator and Supplicant, respectively. The pseudorandom function $\operatorname{\mathrm{PRF-X}}$ is defined as follows for $X = 128,192,256,384,512$:

   PRF-X(K,A,B):
      for i = 0 to (X + 159) / 160:
          Z = Z || HMAC-SHA1(K, A || 0 || B || i)
      return LeftBits(Z,0,X)
   

2. The MICs are computed using either HMAC-SHA1-128 or AES-CMAC-128 (which one to use is negotiated during the handshake).

3. The GTK is simply chosen at random by the AP.