Re: [PATCH 00/11] Basic SAE support for AP mode

[James Prestwood <prestwoj@gmail.com>]

Hi John,

On 4/21/24 5:50 AM, John Brandt wrote:
> This set of patches adds basic SAE support for IWD in AP mode. It has
> been tested by connecting to IWD AP using wpa_supplicant. Note that this
> does not yet correspond to WPA3, since WPA3 would also require the
> support of Management Frame Protection.
>
> Normal client functionality has also been confirmed to still work. After
> applying these patches it remains possible for IWD client to connect to
> WPA3/SAE network.
>
> Remaining TODOs are to include better sanity-checking of received
> frames.

I took a quick pass and I'm impressed you took the initiative to 
implement this. I do need to take a closer look from the spec side of 
things but overall it looks good.

Assuming we are compliant with the spec my only concern merging this 
would be the TODOs. You do mention this is experimental and certain 
checks are not done, but you'd be surprised at the number of people 
using IWD in AP mode. The minute we merge this we're going to have 
people using it, which in its current form would be insecure. I think we 
first need to get the frame verification implemented as well as MFP. But 
anyways, this is a good start and I'll give it a full review when I have 
some time, hopefully this week.

Thanks,

James

>
> John Brandt (11):
>    ap: ability to advertise PSK and SAE
>    ap: accept PSK/SAE in auth depending on config
>    sae: add function sae_set_group
>    sae: refactor and add function sae_calculate_keys
>    sae: make sae_process_commit callable in AP mode
>    sae: verify offered group in AP mode
>    sae: support reception of Confirm frame by AP
>    ap: add support to handle SAE authentication
>    ap: enable start of 4-way HS after SAE
>    eapol: support PTK derivation with SHA256
>    eapol: encrypt key data for AKM-defined ciphers
>
>   src/ap.c    | 135 +++++++++++++++++++++++++++++++++-------
>   src/eapol.c |  58 ++++++++++++-----
>   src/sae.c   | 175 +++++++++++++++++++++++++++++++++-------------------
>   3 files changed, 265 insertions(+), 103 deletions(-)
>