3
$\begingroup$

I recently study WPA/WPA2 security and I want to know how PTK is derived. I found these parameters in the IEEE 802.11 standard (2012):

PRF - X(PMK, “Pairwise key expansion”, Min(AA,SPA) || Max(AA,SPA) || Min(ANonce,SNonce) || Max(ANonce,SNonce))

where X = 256 + TK_bits. The value of TK_bits is cipher-suite dependent

And only one page is about PRF in the IEEE 802.11 document.

The mystery for me is the PRF or pseudorandom function. How does it work? Does it have any algorithm or method? I have searched, but I have not found any concrete examples with concrete numbers and step by step tutorial or any code implementations.

$\endgroup$
2
$\begingroup$

The page you linked to directly gives the algorith to calculate ${\rm PRF}(K, A, B, Len)$:

$\hspace{2em} \textbf{for }i \leftarrow 0 \textbf{ to } (Len+159)/160 \textbf{ do} \\ \hspace{4em} R \leftarrow R \mathbin\| \text{H-SHA-1}(K, A, B, i) \\ \hspace{2em} \textbf{return } \text{L}(R, 0, Len)$

The helper function $\text{H-SHA-1}$, the string concatenation operator $\|$ and the meaning of the parameters are all defined just above this code on the page. The helper function $\rm L$ does not seem to be defined on the page you linked to, but from context, it seems likely that ${\rm L}(R, 0, Len)$ is meant to return the first $Len$ bits (i.e. the first $Len/8$ bytes) of the string $R$. You'll probably find its precise definition somewhere earlier in the document.

(Also, the algorithm as given doesn't specify the initial value of the string $R$, but it seems obvious enough that it's meant to be initially empty.)

Below this algorithm, the page defines five specific "wrapper functions" $\text{PRF-}X$, for $X \in \{128, 192, 256, 384, 512\}$, simply as $$\text{PRF-}X(K, A, B) = \text{PRF}(K, A, B, X).$$ Note, however, that the page also says that different definitions of these wrapper functions, given at the end of the page and the beginning of the next page, are to be used in some cases ("When the negotiated AKM is 00-0F-AC:5 or 00-0F-AC:6...").


In any case, this looks like a common way to extend the HMAC pseudorandom function, which has a variable input length but a fixed output length, into a variable-output-length PRF by repeatedly invoking it with the same input combined with an incrementing counter, and concatenating the results. It looks quite similar to e.g. HKDF-Expand, although HKDF also feeds the previous HMAC output as input to the next HMAC call in order to (hopefully) make any cryptanalytic weaknesses in the underlying hash function harder to exploit. (See section 7 of the HKDF paper for the designers' rationale for this.)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.