1. The Problem in Practice

Capturing WPA2 handshakes in a public space requires nothing more than a laptop running Kali Linux and a wireless adapter in monitor mode. The BSSIDs, MAC addresses, channels, and client associations are all visible over the air to anyone listening. This is not a theoretical attack. The tooling is free, documented, and widely used (Aircrack-ng Project, “Aircrack-ng Documentation”).

2. How the WPA2 Attack Works in Practice

What he was running is the same WPA2-PSK attack chain that has been floating around for more than a decade. It is predictable, reliable, and far too easy to execute. Kali Linux wraps all the tools in one distro, and the whole thing fits in four steps.

Step 1: Passive Scanning

The attacker uses airodump-ng to watch the air (Aircrack-ng Project, “Aircrack-ng Documentation”). No intrusion required. No skill. The following data is just floating in the spectrum, capturing it isn’t breaking anything:

airodump-ng wlan0mon

# Passively enumerates:
#   BSSID          AP MAC address
#   CH             Operating channel
#   CIPHER         CCMP or TKIP
#   AUTH           PSK or MGT
#   STATION        Associated client MACs
#   ESSID          Network name

Step 2: Target Lock, Client + AP Pair

The attacker picks one client associated with the target AP. That client is the doorway into the PSK. They lock airodump-ng onto the target channel and BSSID:

airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Step 3: Deauthentication Frames

Using spoofed 802.11 management frames, if 802.11w is not enabled, which in public Wi-Fi it usually isn’t, the attacker sends a burst of deauth packets to the client (IEEE, “IEEE 802.11-2020”):

# Sends 10 spoofed deauth frames to the target client
# Client trusts the frames, drops association, begins reconnecting immediately
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

• The client trusts those deauth frames.
• The client drops off the AP.
• The AP doesn’t challenge the authenticity of the frame.

This forces the client to immediately reconnect, and that reconnect is where the handshake lives.

Step 4: Capture the WPA2 4-Way Handshake

As the client reconnects, the AP and STA exchange the ANonce/SNonce + MIC frames that form the 4-way handshake. airodump-ng captures this in real time. Once captured, the attacker has everything needed to brute-force the PSK offline, no further network interaction required (IEEE, “IEEE 802.11-2020”).

# airodump-ng confirms the capture:
# WPA handshake: AA:BB:CC:DD:EE:FF

# Feed the capture directly into hashcat for GPU-accelerated offline cracking
hashcat -m 22000 capture.hccapx /usr/share/wordlists/rockyou.txt

3. How WPA3-SAE Breaks the Attack Chain

This is exactly why WPA3 changes the game. WPA3-Personal replaces the WPA2 PSK handshake with SAE, Simultaneous Authentication of Equals, which is a Password-Authenticated Key Exchange (PAKE) built specifically to eliminate offline dictionary attacks (Wi-Fi Alliance, “WPA3 Specification”).

Instead of revealing material that can be cracked later, the SAE handshake never exposes anything useful. An attacker who wants to guess the password has to interact with the AP for every single guess. Each attempt is rate-limited and highly visible. Deauthentication tricks don’t give them anything, because there is nothing reusable in the SAE exchange. This alone shuts down the entire WPA2 capture-and-crack methodology.

What SAE Changes

• No reusable handshake material. SAE handshake frames don’t contain anything an attacker can brute-force offline.
• No offline dictionary cracking possible. To guess the password, the attacker must interact with the AP for each guess. That’s rate-limited. That’s detectable. That’s effectively impossible at scale.
• Deauth captures become worthless. Even if they force reconnections, there is nothing to “capture and crack.”
• Forward secrecy is built-in. Every authentication event produces new cryptographic material. Past sessions remain protected even if a password is later exposed.

4. How OWE Kills the WPA2-Style Attack

OWE takes things even further for SSIDs that are meant to be open. Instead of leaving traffic unencrypted or relying on captive portals, OWE forces a Diffie-Hellman exchange during association. Every client generates its own unique encryption keys with the AP. There is no pre-shared key at all (Harkins and Kumari, “Opportunistic Wireless Encryption”).

The resulting PMK is unique per session, derived from ephemeral cryptographic values, and never transmitted in a form an attacker can exploit. Even if someone captures every association frame and every handshake, none of it can be used to decrypt traffic or brute-force a credential. Deauthing a client only forces them to generate a new ephemeral key, which is just as useless to an attacker as the last one.

Why OWE Eliminates the Attack Entirely

• No PSK means no target to brute-force. There is no shared key. No pre-distributed secret. Nothing static.
• Per-client Diffie-Hellman key exchange. Each client gets its own encryption keys formed from an ephemeral D-H exchange. An attacker sniffing the association cannot derive those keys.
• The 4-way handshake is no longer the weak point. The PMK used in the handshake is unique per session and derived from ephemeral values.
• Deauth attacks lose their value. Even if they force a reconnect, the attacker never gets anything reusable.

5. OWE Under the Hood: The Cryptographic Details

When we talk about OWE, what the Wi-Fi Alliance brands as “Enhanced Open”, we’re talking about taking the old, wide-open guest SSID model and bolting real cryptography onto it without making the user deal with passwords or portals. OWE comes straight out of RFC 8110, the work Dan Harkins and Warren Kumari put together to fix the long-standing problem of unencrypted “open” networks (Harkins and Kumari, “Opportunistic Wireless Encryption”).

Even though the SSID still looks open from a client perspective, the Beacon frames actually advertise an RSN element. That’s the giveaway. Real open networks never include an RSN because there’s nothing to negotiate, no keys, no AKM, no cipher suites. But with OWE, the AP includes AKM type 18 (that’s the OWE indicator) and CCMP-128 for both pairwise and group ciphers, even before anybody associates (Chaskar, “WPA3, OWE, and DPP”).

The Elliptic Curve Key Exchange

Under the hood, OWE leans on Diffie-Hellman for its key establishment, just like WPA3-Personal does with SAE, but without the password component. OWE is strictly about generating shared secret material using public key exchanges in the clear, then turning that secret into encryption keys for the session (IEEE, “IEEE 802.11-2020”).

The spec requires elliptic curve groups. You’ll see references to groups 19, 20, and 21, these are predefined elliptic curves. Group 19 is the common 256-bit NIST P-256 curve (IEEE, “IEEE 802.11-2020”). That’s the math environment both the AP and the client operate in when they generate their key pairs.

The Association Exchange, Step by Step

When a client joins an OWE SSID, the process looks similar to a legacy open association, but the frames tell a completely different story. The AP and the STA each generate their own private key, just a large random scalar from the curve’s field. They both multiply that private key by the group’s generator point, producing a public key. Those public keys get tucked into the Association Request and Association Response frames. That is the visible difference from legacy open Wi-Fi, you can see the cryptographic material being exchanged if you inspect the frames (Harkins and Kumari, “Opportunistic Wireless Encryption”).

# Conceptual OWE key exchange flow (NIST P-256, Group 19):

# --- Client ---
# private_key_c  = random scalar from curve field
# public_key_c   = private_key_c * G       (G = curve generator point)

# --- AP ---
# private_key_ap = random scalar from curve field
# public_key_ap  = private_key_ap * G

# Frame exchange:
# Association Request  --[OWE IE: public_key_c]-->  AP
# Association Response <--[OWE IE: public_key_ap]-- AP

# --- Shared secret derivation (never transmitted) ---
# Client: shared = private_key_c  * public_key_ap
# AP:     shared = private_key_ap * public_key_c
# Result: identical point on the curve, ECDH property

# shared point  -->  HKDF  -->  PMK  -->  EAPOL 4-way  -->  PTK / GTK

Once the Association exchange finishes, both sides run their Diffie-Hellman operation. The client takes the AP’s public key and multiplies it by its own private key. The AP does the same in reverse. Because of the mathematical properties of the curve, they arrive at the same shared secret without ever sending it over the air. That secret feeds into the EAPOL key exchange that follows, which produces the Pairwise Master Key used for encrypting all data frames. After that last key message, everything between AP and client is encrypted, on what the user still sees as “open Wi-Fi.”

6. WPA2 vs. WPA3-SAE vs. OWE: Side-by-Side

Seeing Kali in Starbucks wasn’t just an interesting moment, it was a reminder of how outdated WPA2 really is. The entire attack depends on reusable secrets and a handshake that leaks enough information to crack those secrets offline. WPA3 and OWE eliminate the weak points altogether by removing reusable keys and replacing them with per-session cryptographic exchanges that attackers can’t meaningfully exploit. WPA2 wasn’t built for the threat landscape we have now. WPA3 and OWE are.