Wireshark-dev: Re: [Wireshark-dev] Cannot Decrypt Fast BSS Transition (802.11r) Packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Mikael Kanstrup <mikael.kanstrup@xxxxxxxxx>
Date: Sat, 16 May 2020 17:46:40 +0200

The idea is to allow user to enter TK as decryption key. When decrypting packets if no valid SA exist either due to 4WHS missing in packet capture or due to non supported AKMS Wireshark would try decrypting using all user entered TKs and all supported ciphers. If a packet can be successfully decrypted an SA would be formed from the inputs used. Then on subsequent packets the SA already exists and decryption can continue without repeated attempts. Performance should be acceptable I hope.

I uploaded a non-finished patch implementing support for decryption using TK entered by user here:

Mohit Khattar: If you know how to download patches from Gerrit and build, feel free to try it out. Hopefully it can be used to successfully decrypt your FT captures.

/Mikael