Thanks for clarifications. What I had in mind was the following case: if you disrupt someone's connectivity (jam the channel for some time) and force them to r

Thanks for clarifications. What I had in mind was the following case: if you disrupt someone's connectivity (jam the channel for some time) and force them to reconnect, having listened to nonces and knowing pre-shared secret, you can calculate PMK (and GTK), or I'm wrong? (I haven't re-checked the specs, but believe 802.11 headers are unencrypted - only payload is - so MACs are not secret.)