Re: [PATCH v2 4/9] ft: add FTE/RSNE building to ft_prepare_handshake

Denis Kenzior
2023-12-06T17:14:55Z

Hi James,

>>> +    handshake_state_set_fte(hs, fte);
>>
>> However, this is less clear to me.  Looking at how FILS and FT uses this API,
>> it seems that set_fte is meant for the authenticator FTE element?  So I think
>> rekeying after FT would be broken by this change.
>
> Good question. Rekeys do appear to work as-is but you are right, FILS/FT uses
> set_fte() for the authenticators element, but eapol seems to use hs->fte for

I'm pretty sure the intent was for the FTE element to be from the authenticator.

> building message 2/4, as well as checks that the handshakes FTE matches what the

I'll have to look at how ptk_2_of_4 uses it. Memory is fuzzy now. Need to open
the spec.

> authenticator sends in 3/4. maybe this is actually a bug in eapol? I think the
> reason everything "works" is because the FTE should be the same between both peers.

Yes, but also we have logic in: netdev_connect_event() that sets the FTE from
the response IEs. So that's probably how things end up working in the end.

>
> We may want to refactor and do:
>
> handshake_state_set_authenticator_fte()
>
> handshake_state_set_supplicant_fte()

Yeah, that seems reasonable.

Regards,
-Denis