We have already seen in the previous section that if we have the correct passphrase in our dictionary, cracking WPA-Personal will work everytime like a charm. So why we don't just create a large elaborate dictionary of millions of common passwords and phrases people use? This would help us a lot and most of the time, we would end up cracking the passphrase. It all sounds great, but we are missing one key component here—time taken. One of the more CPU and time-consuming calculations is that of the Pre-Shared Key using the PSK passphrase and the SSID through the PBKDF2. This function hashes the combination of both over 4,096 times before outputting the 256 bit Pre-Shared Key. The next step of cracking involves using this key along with parameters in the four-way handshake and verifying against the MIC in the handshake. This step is computationally inexpensive. Also, the parameters will vary in the handshake everytime and hence, this step cannot be pre-computed. Thus to speed up the cracking process we need to make the calculation of the Pre-Shared Key from the passphrase as fast as possible.

We can speed this up by pre-calculating the Pre-Shared Key, also called the Pairwise Master Key (PMK) in the 802.11 standard parlance. It is important to note that, as the SSID is also used to calculate the PMK, with the same passphrase but a different SSID, we would end up with a different PMK. Thus, the PMK depends on both the passphrase and the SSID.

In the next exercise, we will look at how to pre-calculate the PMK and use it for WPA/WPA2 PSK cracking.