>There's no need for a second AP in all this, just someone in range of the client who can replay packets to the clients.
How would you drop packet 3 without a new AP?
How would you drop packet 3 without a new AP?
> Note that the adversary cannot replay an old message 3, because its EAPOL replay counter is no longer fresh.
And a related update from the TLDR post you originally referenced (which I believe is causing confusion):
> Update: An early version of this post suggested that the attacker would replay the message. Actually, the paper describes forcing the AP to resend it by blocking it from being received at the client. Thanks to Nikita Borisov for the fix.