2

When I log into a WPA/WPA2 Wi-Fi network (in my case an AVM FritzBox router) and I type the wrong WLAN password, is the router able to "see" my wrong typed password?

(Is it possible, with all the information the router receives/sends, to obtain a wrong typed password?)

And in which part of the 4 way handshake is the WLAN password involved?

3

No, it's not possible for the AP to discover what passphrase a user entered incorrectly.

If you think about it, it were possible, then stealing Wi-Fi passphrases would be the easiest thing in the world. The hacker just has to put up his own impostor AP publishing the same network name, and when people try to join it, he can steal their "bad" passphrase attempts, which are probably the "correct" passphrase for the real network.

The 4 way handshake doesn't exactly involve the passphrase. It is never sent across the air, not even in encrypted form. The handshake is designed such that it wouldn't work out, mathematically, unless both sides already know the correct password.

  1. The first two messages are where the AP (router) and STA (client) each sends the other a randomly generated number known as a "nonce".
  2. Both sides are able to use these two nonces, along with the passphrase and network name, to derive the Pairwise Temporal Key (PTK) that they will be using for this session.
  3. For message 3, the AP encrypts the Group Temporal Key (GTK; the multicast/broadcast encryption key) using the PTK it derived.

If the STA can't decrypt the GTK from message 3, it knows it doesn't have the same PTK as the AP is using. So one of the following must be true (listed in descending order of likelihood):

  1. The STA got the passphrase wrong.
  2. The AP is misconfigured.
  3. The AP is an impostor.
  4. There's a bug somewhere.

By the way, note that anyone who captures those two nonces with a sniffer, and already knows the network passphrase, can decrypt all the traffic sent and received by that client during that session (assuming they aren't also encrypted at a higher layer like SSL/TLS or VPN). So your traffic on a WPA2-PSK (WPA2 Personal) network is not terribly secure if people you don't trust already know the passphrase, as may be the case on a public/guest Wi-Fi network in a coffee shop, store, hotel, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.