urity network (TSN). RSN Key Management After security parameter negotiation, the next stage in establishing a connection between a client station and an access point is mutual authentication using 802. 1x or PSK authentication, as described in the Section "802.1x Authentication Framework, p. 214". At the end of this authentication exchange, the authentication server generates a pairwise master key or alternatively, in personal mode, the key is derived from the user entered password or passphrase. Pairwise Key Hierarchy and the 4-way Handshake Pairwise keys are used to protect unicast messages between a client station and access point. The hierarchy of keys and the handshake that establishes and installs them are described in Table 8-5. The purpose of the 4-way handshake, shown in Figure 8-7, is to install this key hierarchy securely in both the client station (supplicant) and the access point (authenticator). Each of the four steps involves the transmission of an EAPoL key exchange message, as follows; Step (1) The access point (authenticator) generates a pseudo-random nonce (ANonce) and sends this to the supplicant. Step (2) The client station (supplicant) generates a pseudo-random nonce (SNonce) and is then able to compute the PTK and derive the KCK and KEK. The supplicant sends its SNonce to the authenticator, together with the security parameters previously negotiated. The KCK is used to compute a MIC that assures the origin of the message. Wireless LAN Security Table 8-5: Pairwise Key Hierarchy Pairwise keys Description Pairwise master key (PMK) Starting point of the pairwise key hierarchy, either generated by the authentication server or derived from the user entered password if 802. 1x authentication is not being used. Pairwise transient key (PTK) The PTK is derived from the PMK together with the MAC addresses of the client station and access point, and a nonce (see Glossary) provided by each party during the 4-way handshake. EAPoL key confirmation key The KCK is used to assure authenticity of messages (K