Re: [PATCH v2 4/9] ft: add FTE/RSNE building to ft_prepare_handshake

[Denis Kenzior <denkenz@gmail.com>]

Hi James,

>>> +    handshake_state_set_fte(hs, fte);
>>
>> However, this is less clear to me.  Looking at how FILS and FT uses this API, 
>> it seems that set_fte is meant for the authenticator FTE element?  So I think 
>> rekeying after FT would be broken by this change.
> 
> Good question. Rekeys do appear to work as-is but you are right, FILS/FT uses 
> set_fte() for the authenticators element, but eapol seems to use hs->fte for 

I'm pretty sure the intent was for the FTE element to be from the authenticator.

> building message 2/4, as well as checks that the handshakes FTE matches what the 

I'll have to look at how ptk_2_of_4 uses it.  Memory is fuzzy now.  Need to open 
the spec.

> authenticator sends in 3/4. maybe this is actually a bug in eapol? I think the 
> reason everything "works" is because the FTE should be the same between both peers.

Yes, but also we have logic in: netdev_connect_event() that sets the FTE from 
the response IEs.  So that's probably how things end up working in the end.

> 
> We may want to refactor and do:
> 
> handshake_state_set_authenticator_fte()
> 
> handshake_state_set_supplicant_fte()

Yeah, that seems reasonable.

Regards,
-Denis