Understanding EAPOL 4-Way Handshake and PMKID cracking
#5
Correct: reuse PBKDF2
That means that a PMK is calculated only once for an ESSID-PSK combination and compared against all hashes using the same ESSID.

This line will give you information about it:
Recovered........: 0/10 (0.00%) Digests
10 hashes using the same ESSID (salt)

Running hashcat against test.22000 file converted by hcxpcapngtool --all:
Recovered........: 69/35766 (0.19%) Digests, 10/631 (1.58%) Salts
35766 hashes using 631 ESSIDs (salts)
Please keep in mind:
That (--all) is an analysis mode (as well as hashcat modes 22001 and deprecated 2501 and 16801)

BTW:
Time.Estimated...: Wed Apr 1 23:18:57 2020 (6 hours, 30 mins)
is an average value. It may change during runtime.

To determine the exact time (inclusive init and de-init) "time" should be the first choice:
Code:
$ time hashcat -m 22000 ......

BTW 2:
--nonce-error-corrections have a deep impact on hashcat speed
Reply


Messages In This Thread
RE: Understanding EAPOL 4-Way Handshake and PMKID cracking - by ZerBea - 04-01-2020, 05:35 PM