3 ms·
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not
by est31 7y ago
It's unfair to say that there is no salting. The PMK is derived from the WiFi network name (SSID) as well as the password [1]. The SSID acts as a salt here. Not perfect as SSIDs are often not unique, but it's certainly better than no salting at all.
[1]: https://www.ins1gn1a.com/understanding-wpa-psk-cracking/ https://www.ins1gn1a.com/understanding-wpa-psk-cracking/
- Scoundreller 7y agoSo stupid they don’t use the MAC as the salt.
- TheLastPass 7y agoI said "IF" there's no salting. In any case, I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.
- est31 7y ago> I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed. Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.
- austinheap 7y agoThis is why we have rainbow tables.