PMKID Attack.

An offline WPA/WPA2-PSK cracking method that derives the passphrase from a single PMKID field captured from an access point, no client needed. It belongs to the Attacks & Threats category of cybersecurity.

An offline WPA/WPA2-PSK cracking method that derives the passphrase from a single PMKID field captured from an access point, no client needed.

The PMKID attack was published in August 2018 by Jens Steube, lead developer of hashcat. It targets the optional RSN PMKID element that 802.11i access points send in the first EAPOL message when roaming is supported. The PMKID is computed as HMAC-SHA1(PMK, 'PMK Name' | BSSID | client MAC), so once an attacker captures a single PMKID from a beacon-driven association attempt, they can run a hashcat -m 22000 dictionary or mask attack offline. Unlike the classic four-way-handshake capture, no legitimate client needs to be present. Mitigations: disable PMKID where unused, deploy WPA3-SAE, and use long random passphrases or 802.1X enterprise authentication.

Defences for PMKID Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: RSN PMKID attack, Hashcat WPA attack.