John Fremlin's blog: WPA supplicant and TKIP pairwise cipher

On some wifi routers, the CCMP WPA pairwise cipher does not work with wpa_supplicant, though the key is correct, but the TKIP cipher will work. The router advertises Pairwise Ciphers (2) : TKIP CCMP.

wpa_supplicant says

State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from xx:xx:xx:xx:xx:xx (ver=2)
WPA: PTK derivation - A1=xx:xx:xx:xx:xx:xx A2=xx:xx:xx:xx:xx:xx
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=48): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=24): 
WPA: Sending EAPOL-Key 2/4
Authentication with xx:xx:xx:xx:xx:xx timed out.

or

WPA: 4-Way Handshake failed - pre-shared key may be incorrect

To workaround, add pairwise=TKIP to the entry in wpa_supplicant.conf.