So I know for unicast traffic PTK is used to encrypt and obtain ciphertext; and for multicast traffic GTK is used to encrypt and obtain ciphertext. I know PTK is produced at a 4 way handshake, and also the router provides the GTK on the 3rd way of the handshake.
And more importantly, depending on the network, these keys are changed at hour intervals for further protection.
In my operating system, Windows and Ubuntu, I want to know where PTK and GTK are stored. I want to make a test for fun and take PTK/GTK from my local device; and use an outsider device to encrypt packets with the keystreams and send packets to the network.
I assume they would be stored in the kernel, but where exactly? Is it possible anyhow to retrieve them from the OS?
so Pair Transient Key should be a 64 byte key, and needs to have a store in the OS.