Key Data Data

Encryption variable EAPOL-Key descriptor unverified

The RSN element in messages 2 and 3, plus the wrapped group key in message 3. Empty in messages 1 and 4.

Reading a capture

Message 2 echoes back the RSN element the station sent in its association request, and message 3 echoes the one from the beacon. That is the downgrade protection: if an attacker altered either element in the unprotected frames earlier, the echo will not match what was seen and the handshake fails.

Where it sits

EAPOL-Key > Key Data

Open in the explorer — Four-way handshake message 1
Open in the explorer — Four-way handshake message 2
Open in the explorer — Four-way handshake message 3
Open in the explorer — Four-way handshake message 4

Accuracy

Clause: 802.11-2024 §12.7.2
Verified: Not verified against the standard. Treat this as a claim, not a fact.