From: James Prestwood <prestwoj@gmail.com>
To: Denis Kenzior <denkenz@gmail.com>, Bryce Johnson <bryce@redpinelabs.com>
Cc: "iwd@lists.linux.dev" <iwd@lists.linux.dev>
Subject: Re: [PATCH 1/2] handshake: include additional sha256 AKMs for PMKID generation
Date: Wed, 27 Sep 2023 09:53:43 -0700 [thread overview]
Message-ID: <87dba12f-bf3c-40dc-8bc7-00b34074fdcb@gmail.com> (raw)
In-Reply-To: <ccaa868f-d803-24e8-733e-91c6d6d3b282@gmail.com>
Hi Denis,
On 9/27/23 9:47 AM, Denis Kenzior wrote:
> Hi James,
>
>> I believe yes, it can skip SAE entirely using Open Authentication:
>>
>> 12.6.10.3
>> "If a STA in an infrastructure BSS has determined it has a valid PMKSA
>> with an AP to which it is about to (re)associate, it performs Open
>> System authentication to the AP"
>>
>> So in that regard its faster, your saving 2 messages essentially
>> (since open auth still requires a request/reply).
>
> My memory is fuzzy here now. Aren't we skipping Authenticate frames and
> go straight to Reassociate? Or is the kernel still sending an
> Authenticate frame as a result of netdev_reassociate?
Whether or not the kernel sends an auth is a separate question, as we've
seen it erroneously do before :) But it appears the spec still expects
an auth frame request/reply:
"Upon receipt of a (Re)Association Request frame with one or more PMKIDs
following Open System authentication or (only in the case of a DMG AP)
if IEEE 802.11 authentication was not performed, an AP checks whether
its Authenticator has cached a PMKSA for the PMKIDs and whether the AKM
in the cached PMKSA matches the AKM in the (Re)Association Request"
>
>>
>> But this all gets beat by FT anyways since you can skip the 4-way
>> handshake. I think this was all considered when we decided whether or
>> not to implement PMKSA, it just didn't seem worth it since FT exists
>> and is superior.
>>
>
> Agreed, but WPA3-Personal is less likely to support FT. Also this is
> potentially beneficial for non-roaming scenarios. I.e. just reconnect
> after sleep, etc.
>
> Regards,
> -Denis
next prev parent reply other threads:[~2023-09-27 16:53 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-04 20:38 [PATCH 1/2] handshake: include additional sha256 AKMs for PMKID generation James Prestwood
2023-04-04 20:38 ` [PATCH 2/2] eapol: warn rather than reject invalid PMKID (for EAP) James Prestwood
2023-04-09 17:22 ` Denis Kenzior
2023-04-09 17:21 ` [PATCH 1/2] handshake: include additional sha256 AKMs for PMKID generation Denis Kenzior
2023-04-10 17:10 ` James Prestwood
2023-04-16 16:37 ` Denis Kenzior
2023-04-17 19:35 ` James Prestwood
2023-04-23 23:05 ` Denis Kenzior
2023-09-05 16:33 ` Johnson, Bryce
2023-09-05 16:52 ` James Prestwood
2023-09-05 19:09 ` James Prestwood
2023-09-07 20:40 ` Johnson, Bryce
2023-09-08 13:33 ` James Prestwood
2023-09-08 14:01 ` Johnson, Bryce
2023-09-08 14:11 ` James Prestwood
2023-09-26 15:16 ` Bryce Johnson
2023-09-26 15:51 ` James Prestwood
2023-09-26 16:54 ` Bryce Johnson
2023-09-26 17:13 ` James Prestwood
2023-09-26 19:18 ` Denis Kenzior
2023-09-27 15:56 ` Bryce Johnson
2023-09-27 16:13 ` James Prestwood
2023-09-27 16:47 ` Denis Kenzior
2023-09-27 16:53 ` James Prestwood [this message]
2023-09-27 16:40 ` Denis Kenzior
2023-04-09 17:23 ` Denis Kenzior
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87dba12f-bf3c-40dc-8bc7-00b34074fdcb@gmail.com \
--to=prestwoj@gmail.com \
--cc=bryce@redpinelabs.com \
--cc=denkenz@gmail.com \
--cc=iwd@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).