Re: Simulating a PMKID attack

On Wed, Feb 19, 2020 at 12:23:31PM +0200, Or Yacobi wrote:
> We are trying to simulate a PMKID attack using hostap (Mininet wifi AP).
> We successfully enabled 802.11r roaming, and tried many hostapd
> configurations (including rsn_preauth, okc, ft_psk_generate_local and
> pmk_r1_push) but haven't seen the PMKID in the first EAPOL message.
> Are you familiar with a configuration that generates the key data
> field in the first message?

What exactly do you mean with "PMKID attack"? And what is the "first
EAPOL message" referring to? EAPOL-Key msg 1/4 during the initial FT
mobility domain association? If so, please note that the IEEE 802.11
standard does not include PMKID in that frame.

-- 
Jouni Malinen                                            PGP id EFC895FA