My question is, where does the 4 way handshake fit in on the 802.11 authentication level? After the Authentication request?
Referring to the 4 states an 802.11 station can be with respect to the Robust Security Network (RSN), we see that:
- moving from state 1 to state 2 happens when 802.11 Authentication completes successfully (the Open Systems Authentication you see in the diagram in the question)
- moving from state 2 to state 3 happens when Association completes successfully
However, state 3 is "pending RSN Authentication". Getting to state 4 involves one of the following:
- in personal mode, the station and AP share a shared secret (typically, derived from a shared passphrase), which then goes as input to the 4-way handshake. At no point in the 4-way handshake is it sent over the air, of course, but the 4-way handshake allows the various actual session keys to be derived by both sides.
- in enterprise mode, the station goes through 802.1X authentication (various EAP-supported authentication methods are possible), followed by the station and AP proceeding with the 4-way handshake.