Re: Please add SAE support for WiFi



On 12/16/2011 12:19 PM, Dan Williams wrote:
On Fri, 2011-12-16 at 11:36 -0500, Robert Moskowitz wrote:
The 802.11s standard is now published.  Boy did that take long enough!  :)

There is a new password authentication method in 11s that the way it was
defined will work just fine between an AP and STA, or in adhoc between
two STAs.  This method is called "Secure Authentication of Equals" or
SAE.  It is a zero-based knowledge authenticaiton method that is immune
to offline attacks and an active attack gets only one guess per attack.
SAE is defined in Section 8.2a of 802.11s-2011.  It is already in the
OpenAP code (or so its author, Dan Harkins of Aruba told me).

We finally have a strong password authentication method for WiFi.  BTW,
I am the author of the first paper on how to attack WPA-PSK, so I am
directly involved in 802.11 security issues.

I would hope to see SAE in APs in the near future.
The process typically is to make sure that wpa_supplicant and the kernel
drivers support the feature in question, and then finally we can modify
NM to make use of it too.  I'll be on the lookout for SAE support
there...

I sent this message also to the Fedora test list. That is the closest list I am on to the developers.

I am right now in the need of a new AP, so I am searching for one that I can afford that will be able to get SAE support.




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]