Re: [PATCH v2 4/9] ft: add FTE/RSNE building to ft_prepare_handshake

James Prestwood
2023-12-06T17:59:04Z

On 12/6/23 09:14, Denis Kenzior wrote:
> Hi James,
>
>>>> +    handshake_state_set_fte(hs, fte);
>>>
>>> However, this is less clear to me.  Looking at how FILS and FT uses
>>> this API, it seems that set_fte is meant for the authenticator FTE
>>> element?  So I think rekeying after FT would be broken by this change.
>>
>> Good question. Rekeys do appear to work as-is but you are right,
>> FILS/FT uses set_fte() for the authenticators element, but eapol
>> seems to use hs->fte for
>
> I'm pretty sure the intent was for the FTE element to be from the
> authenticator.
>
>> building message 2/4, as well as checks that the handshakes FTE
>> matches what the
>
> I'll have to look at how ptk_2_of_4 uses it.  Memory is fuzzy now.
> Need to open the spec.

All I could find quickly was:

12.7.6.3 4-way handshake message 2

"and that the FTE and MDE are the same as those provided in the AP’s
(Re)Association Response frame"

So it does appear for EAPoL its the authenticators FTE.

>
>> authenticator sends in 3/4. maybe this is actually a bug in eapol? I
>> think the reason everything "works" is because the FTE should be the
>> same between both peers.
>
> Yes, but also we have logic in: netdev_connect_event() that sets the
> FTE from the response IEs.  So that's probably how things end up
> working in the end.
>
>>
>> We may want to refactor and do:
>>
>> handshake_state_set_authenticator_fte()
>>
>> handshake_state_set_supplicant_fte()
>
> Yeah, that seems reasonable.
>
> Regards,
> -Denis