The four-way handshake is a WPA key-establishment exchange between an associated wireless client and access point. It confirms that both use the same pre-shared key (PSK) and generates unique encryption keys for data communication. section 20.2.1
The exchange fits into WPA-Personal authentication as follows:
- The client performs 802.11 Open System Authentication and associates with the access point. section 20.2.1
- The four-way handshake then verifies that the client and access point have matching PSKs. section 20.2.1
- In WPA3-Personal, simultaneous authentication of equals (SAE) occurs before association and is followed by the four-way handshake. section 20.2.1
Operational security distinction
A WPA or WPA2 client may use an 8- to 63-character passphrase converted into a 256-bit PSK. If an attacker captures the four-way handshake, the exchange provides enough information for attempted brute-force attacks against that PSK. WPA3 uses SAE to reduce this exposure before performing the handshake. section 20.2.1 section 20.5
