Is there known way to decrypt WiFi WPA3 with MLO

asked 2025-07-16 20:50:03 +0000

pinebud77 gravatar image

updated 2025-07-16 20:54:18 +0000

I am trying to decode one of the MLO link channel sniffer log encrypted with WPA3.

  • I have PMK
  • I have MLD and local addresses for the same channel for the MLO link.
  • 4way handshake on connection is captured in the sniffer log.

sometimes, if I replace local addresses with MLD addresses. decoding works with PMK in Wireshark. in some cases, the same above operation does not decode sniffer log.

The questions are

  • Is there plan to support MLO decoding with Wireshark?
  • Is there temporary, proven, method to decode MLO + WPA3 encoding with PMK?

Thank you.

edit retag flag offensive close merge delete

Comments

Can you update the question with output of wireshark -v or copy Help->About Wireshark:Wireshark tab.

Chuckc gravatar imageChuckc ( 2025-07-17 12:36:42 +0000 )edit
% /Applications/Wireshark.app/Contents/MacOS/Wireshark -v
Wireshark 4.4.7 (v4.4.7-0-g7980339b1630).

Copyright 1998-2025 Gerald Combs <[email protected]> and contributors.
Licensed under the terms of the GNU General Public License (version 2 or later).
This is free software; see the file named COPYING in the distribution. There is
NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) using Clang 14.0.3 (clang-1403.0.22.14.1), with GLib 2.80.3,
with Qt 6.5.3, with libpcap, without POSIX capabilities, with zlib 1.2.11, with
zlib-ng 2.1.6, with PCRE2, with Lua 5.4.6, with GnuTLS 3.8.4 and PKCS #11
support, with Gcrypt 1.10.2, with Kerberos (MIT), with MaxMind, with nghttp2
1.62.1, with nghttp3 1.1.0, with brotli, with LZ4, with Zstandard, with Snappy,
with libxml2 2.11.9, with ...
(more)
pinebud77 gravatar imagepinebud77 ( 2025-07-17 16:12:49 +0000 )edit

Thanks for the info screen. I'm not a WiFi or Mac guy. Including the information may help someone that comes along and looks at the question who is.
There seems to have been some recent work in this area:
20533: Wireshark decryption of Wi-Fi 7 WPA3 encrypted frames needs updates for AKM 24

Chuckc gravatar imageChuckc ( 2025-07-17 18:30:47 +0000 )edit
add a comment