Key MIC MIC

Encryption 16 octets EAPOL-Key descriptor unverified

Proof that the sender derived the same pairwise key, computed over this whole EAPOL frame with this field zeroed.

Reading a capture

Zero in message 1, real in the other three. Computed with the key confirmation key — the first sixteen octets of the derived pairwise key — which is why validating it proves both sides agree on a secret neither ever transmitted.

Where it sits

EAPOL-Key > Key MIC

Open in the explorer — Four-way handshake message 1
Open in the explorer — Four-way handshake message 2
Open in the explorer — Four-way handshake message 3
Open in the explorer — Four-way handshake message 4

Accuracy

Clause: 802.11-2024 §12.7.2
Verified: Not verified against the standard. Treat this as a claim, not a fact.