New attack on WPA/WPA2 using PMKID

[codeme]

Why does it fail?

From what I understand, for you to get past the authentication stage you have to beat the EAP negotiation, that's were we stop at. In WPA-PSK you just have to break PBKDF2, Enterprise is a different story.

While WPA-PSK rely only on simmetric/hash initiatives, WPA-Enterprise/802.1x rely on PKI credentials (well, it relies on radius, which does that in turn), therefore you have to go somewhere akin to breaking a x509 certificate to be able to beat it. No go.

I suspect that when you enable fast transitions on an Enterprise network AP it just turns out moot, at least that's what happened here.

Thank you !!

But during your test, did you recover the RSN PMKID? I did, i.e. hcxdumptool correctly captured EAPOL frame 1 of 4. Does that mean that the PKMID is just encrypted garbage in this case?