Authentication before the handshake
WPA2-Personal derives its master key from a password everyone shares; WPA2-Enterprise derives it from a real sign-in. The client associates with 802.1X, but the controlled port stays blocked until EAP succeeds: a TLS tunnel forms against the RADIUS server's certificate, the inner method (MSCHAPv2 or a client certificate) proves identity, and RADIUS returns Access-Accept carrying the Master Session Key.
The access point turns the first 256 bits of that MSK into the PMK and runs the same 4-way handshake as the home-network plate — but now every client holds a unique, per-session key. This plate also walks the two ways it goes wrong: an Access-Reject from bad inner credentials, and the evil-twin attack that harvests credentials whenever the supplicant skips server-certificate validation.