Embed Notice

@dakkar I'm working on a WPA3 SAE-PK credential generator.

It hashes ssid||arbitrary 16 byte value||compressed key in asn.1 der spki format. The standard uses. With the P-256 curve (the only one required by the spec, this uses SHA-256, which has a 64 byte block size.

You need to get either 24 or 40 leading zero bits depending on the the configured security level.

The public key representation has a 26 byte fixed prefix, so a 22 byte ssid will push the actual key part of the key entirely into the second block, and you can then compute the first block, clone it, and try again with a different public key.

For slightly shorter SSIDs you could still do this so long as you had enough bytes of shared prefix. The first byte of the public key is either 02 or 03, so that's trivial, and you can get perhaps two bytes after that matched up with reasonable effort, reducing the ssid length minimum to 19 bytes.

failing that, you can precompute the message schedule for the fixed second block and still get a decent speed up.