Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-16 Thread Mikael Kanstrup
> The idea is to allow user to enter TK as decryption key. When decrypting > packets if no valid SA exist either due to 4WHS missing in packet capture > or due to non supported AKMS Wireshark would try decrypting using all user > entered TKs and all supported ciphers. If a packet can be

Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-15 Thread Mikael Kanstrup
Den fre 15 maj 2020 19:44Richard Sharpe skrev: > On Fri, May 15, 2020 at 10:27 AM Mikael Kanstrup > wrote: > > > > Hi, > > > > Fast BSS Transitioning decryption is unfortunately not supported by > Wireshark. > > > > Wireshark uses passphrase/PSK/PMK together with 4-way handshake to > derive PTK

Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-15 Thread Richard Sharpe
On Fri, May 15, 2020 at 10:27 AM Mikael Kanstrup wrote: > > Hi, > > Fast BSS Transitioning decryption is unfortunately not supported by Wireshark. > > Wireshark uses passphrase/PSK/PMK together with 4-way handshake to derive PTK > and GTK. FT key hierarchy and key derivation is not handled by

Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-15 Thread Richard Sharpe
On Wed, May 13, 2020 at 9:01 PM Mohit Khattar via Wireshark-dev wrote: > > Hi, > > We (myself and Jeff Hansen, CC'd) have been having trouble decrypting data > packets on a monitor-mode capture involving packets between an ath9k client > and a Fast BSS Transition-capable wireless network with

Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-15 Thread Mikael Kanstrup
Hi, Fast BSS Transitioning decryption is unfortunately not supported by Wireshark. Wireshark uses passphrase/PSK/PMK together with 4-way handshake to derive PTK and GTK. FT key hierarchy and key derivation is not handled by the decryption engine so PTK remains unknown which makes decryption

[Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets

2020-05-13 Thread Mohit Khattar via Wireshark-dev
Hi, We (myself and Jeff Hansen, CC'd) have been having trouble decrypting data packets on a monitor-mode capture involving packets between an ath9k client and a Fast BSS Transition-capable wireless network with WPA-EAP encryption. We have tried using the PMK and the PTK from the AP, with no