Every Wi-Fi security mode ends with the same few keys: the PMK, the PTK and its three parts, and the group keys. Pick a mode, then click any key to see where it comes from, who holds it and what it protects, with real values worked out in your browser.
The security modes differ only in how the client and AP get the PMK (Pairwise Master Key): from a passphrase (WPA2-Personal), a Diffie-Hellman exchange (WPA3-Personal, Enhanced Open) or an 802.1X login whose MSK the RADIUS server hands to the AP (Enterprise). From the PMK down, it's the same: the 4-way handshake mixes the PMK with two random numbers into a PTK, which splits into the KCK, KEK and TK, and the AP hands out its group keys encrypted with the KEK.
1 · The key tree
Security mode
CredentialExchange or public inputFrom the authentication serverMaster keys (PMK and its FT relatives)Per-association keys (PTK)Group keys (from the AP)
2 · Who holds which key
Keys never go on the air in the clear. The only things sent openly are the random numbers, the PMKID (a name for the PMK), and the group keys, which travel encrypted with the KEK.
3 · What changes between modes
PMK comes from
PMK size
Key derivation
PTK = KCK + KEK + TK
Data cipher
WPA2-Personal
PBKDF2(passphrase, SSID)
256 bits
PRF-SHA1
128 + 128 + 128 bits
CCMP-128
WPA3-Personal
SAE exchange
256 bits
KDF-SHA256
128 + 128 + 128 bits
CCMP-128 (GCMP-256 optional)
Enhanced Open
Diffie-Hellman in association
256 bits
KDF-SHA256
128 + 128 + 128 bits
CCMP-128
WPA2/WPA3-Enterprise
First 256 bits of the MSK
256 bits
PRF-SHA1 or KDF-SHA256
128 + 128 + 128 bits
CCMP-128
Enterprise + 802.11r
Second 256 bits of the MSK (XXKey) → PMK-R0 → PMK-R1
256 bits
KDF-SHA256
128 + 128 + 128 bits
CCMP-128
WPA3-Enterprise 192-bit
First 384 bits of the MSK
384 bits
KDF-SHA384
192 + 256 + 256 bits
GCMP-256
Abbreviations
The terms used on this page, in alphabetical order.
Authentication and Key Management suite: the method the network uses to authenticate and derive keys (e.g. PSK, SAE, 802.1X). Chooses the key derivation hash.
The port-based access control standard used for enterprise Wi-Fi logins (EAP over the air, RADIUS to the server).
↗ opens a term's full entry in the Wi-Fi Glossary, which explains over 400 Wi-Fi terms with their IEEE 802.11 references.
Notes
Why the 4-way handshake exists: the PMK can stay the same for hours (or, with WPA2-Personal, for as long as the passphrase does). Mixing in two fresh random numbers gives every association its own PTK, and the MIC made with the KCK proves both sides hold the same PMK without sending it. See the 802.11 Connection Walkthrough for the messages themselves.
PMK caching: the PMK and its details (a "PMKSA") are kept for a while, often hours. When a client reconnects to an AP that still holds it, it names it with the PMKID and skips the 802.1X login. Opportunistic key caching (OKC) shares the PMK across a controller's APs; 802.11r replaces this with the PMK-R0/R1 layer.
Group keys are the same for every client on the AP's network, so a client that leaves still knows the current GTK until the next group rekey. Many networks rekey on a timer; rekeying when a client leaves is safer but costs airtime.
Mixed modes: TKIP used a 512-bit PTK (its TK was 256 bits including two Michael keys). Different key derivation functions are chosen by the AKM (the negotiated authentication and key management suite), e.g. 00-0F-AC:1 (802.1X, SHA-1), :5 (802.1X, SHA-256), :8 (SAE), :12 (192-bit), :3 (FT-802.1X).
This model: the sample values are computed in your browser with the real functions (PBKDF2, the IEEE 802.11 PRF and KDF, HMAC), from made-up addresses and random numbers. The MSK and the SAE/OWE shared secrets are random stand-ins, because they come out of exchanges not shown here. The PRF matches the IEEE 802.11 test vector.