11

With the introduction of iOS 11 and macOS High Sierra, a new feature was added: Sharing WiFi Passwords.

enter image description here

This awesome and convenient feature comes with one draw back: The passwords are stored in Keychain encrypted. From my decent knowledge of wifi networks, macOS must be able to decrypt the encrypted key into the plaintext password in order to use it to connect.

How can I decrypt the Keychain key to get the password in plaintext?

Improve this question

2 Answers 2

Reset to default
13

The summary answer is that the password doesn't need to be passed as the authentication can take advantage of a derived value that combines the SSID and the passphrase into a longish hexadecimal string (or value since everything is a number in the end) and stores that. You would need to reverse engineer or crack that intentional one way process to remove the password component of the end product.

Here is an article that describes your question.

Alright, for example here is the password I used: SomeSnazzyPassphrase! And here it is in the keychain after iOS shares it to a Mac CEAF1EE4F3050D25F2EF057A66CFD4570559C95656450407136347B75960255E

Before we understand how to reverse it, we must understand how we got there.

First of all we're using a program called wpa_passphrase, which is used in combination of your SSID and Passphrase, to generate that long encoded string.

This is how we obtained the large "password" above: wpa_passphrase <ssid> [passphrase]
For example wpa_passphrase MySSID SomeSnazzyPassphrase!
And we have the PSK hashed created to be CEAF1EE4F3050D25F2EF057A66CFD4570559C95656450407136347B75960255E

Now as wpa_supplicant uses an AES-based cipher, reversing that isn't going to be easy. In fact, I'm just going to go out on a limb and say it's practically impossible.

Improve this answer
6
  • 1
    I am confused. you talk about PSK hashing, but hashing it is irreversible so how is the second device able to get the password and use it to connect?
    – JBis
    Nov 1, 2018 at 22:38
  • And how do we go from PSK Hash to AES encryption.
    – JBis
    Nov 1, 2018 at 22:39
  • Also do you know if the hashing algorithm uses a salt?
    – JBis
    Nov 1, 2018 at 22:40
  • Sorry, I probably misused the word hashed here and I don't know the internals of the code as much as I'd like to to answer your question.
    – mrpeterson
    Nov 2, 2018 at 2:50
  • 1
    No, hashing is the correct term! WPA-PSK derives the PSK from the SSID and passphrase. This is indeed irreversible. See crypto.stackexchange.com/a/28981
    – lxgr
    Jan 16, 2019 at 11:14
0

Open the app "Keychain Access".

Search for the name of the WiFi network. You'll see it listed as an "AirPort network password".

Double click the entry to open the details for the stored password. Then click "Show password".

You'll be prompted to input your account password, and the WiFi password is then shown in plain text.

Improve this answer
8
  • 4
    Again, "The passwords are stored in Keychain encrypted.". They are not shown in plaintext.
    – JBis
    Aug 20, 2018 at 18:16
  • @JBis They are stored in the Keychain encrypted, yes. As I described, you can use the Keychain Access application to decrypt and view the password in plain text.
    – jksoegaard
    Aug 20, 2018 at 20:00
  • Your question is perhaps formulated a bit unclear. Are you saying that you're asking why "shared" WiFi passwords are stored differently than a WiFi password you have entered yourself?
    – jksoegaard
    Aug 20, 2018 at 20:02
  • 3
    I know the feature you are talking about and I have used it constantly. If the password is shared with you and you DO NOT enter it yourself the password is NOT shown in plain text when you go through keychain access.
    – JBis
    Aug 20, 2018 at 20:20
  • 1
    Ah, so now we understand your question. Can you provide an example of how the password looks in Keychain Access?
    – jksoegaard
    Aug 20, 2018 at 21:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .