Wi-Fi Key Hierarchy: From MSK to TK
How Wi-Fi keys are derived, from the passphrase, SAE exchange or 802.1X MSK down to the PMK, PTK, KCK, KEK, TK and group keys, with real worked values.
How to use this tool controls and what to look for
Pick a security mode and follow its keys from the first rung (passphrase, SAE, OWE or EAP) down to the PMK, PTK and group keys.
Controls to change
- Security mode: compare WPA2-Personal, WPA3-Personal (SAE), Enhanced Open (OWE), Enterprise (802.1X), Enterprise + 802.11r (FT) and WPA3-Enterprise 192-bit.
- New sample values: generate new worked values for every key.
What to look for
- Only the source of the PMK changes between modes. From the PMK down, the ladder is the same.
- The 4-way handshake mixes the PMK with the ANonce, SNonce and MAC addresses to make the PTK.
- The PTK splits into the KCK (checks the handshake), the KEK (encrypts the group keys) and the TK (encrypts the data).
- With 802.11r, a PMK-R0 at the controller makes a PMK-R1 for each AP, so roaming skips the full login.
About this tool
Every Wi-Fi security mode ends with the same few keys. This tool follows them from the passphrase, SAE exchange or 802.1X login down to the PMK, the PTK and its three parts (KCK, KEK and TK), and the AP's group keys, including the 802.11r layer. Click any key to see how it's made, who holds it and what it protects, with real values worked out in your browser.
What you'll learn
- Where the PMK comes from in WPA2-Personal, WPA3-Personal, Enhanced Open and Enterprise
- How the 4-way handshake turns the PMK into the PTK
- What the KCK, KEK and TK are each used for
- How 802.11r's PMK-R0 and PMK-R1 make fast roaming possible
Common questions
What is the difference between the MSK and the PMK?
The MSK is 512 bits produced by the 802.1X/EAP login. The PMK is the first 256 bits of it (384 bits in 192-bit mode), shared by the client and the access point.
What is the PTK?
The Pairwise Transient Key, made in the 4-way handshake from the PMK, two random numbers and both MAC addresses. It splits into the KCK, KEK and TK.
What key encrypts Wi-Fi data?
The TK (Temporal Key) encrypts unicast data with CCMP or GCMP. Broadcast and multicast data use the GTK, which the AP shares with every client.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.