Re: [PATCH v2 4/9] ft: add FTE/RSNE building to ft_prepare_handshake

[James Prestwood <prestwoj@gmail.com>]

On 12/6/23 09:14, Denis Kenzior wrote:
> Hi James,
>
>>>> +    handshake_state_set_fte(hs, fte);
>>>
>>> However, this is less clear to me.  Looking at how FILS and FT uses 
>>> this API, it seems that set_fte is meant for the authenticator FTE 
>>> element?  So I think rekeying after FT would be broken by this change.
>>
>> Good question. Rekeys do appear to work as-is but you are right, 
>> FILS/FT uses set_fte() for the authenticators element, but eapol 
>> seems to use hs->fte for 
>
> I'm pretty sure the intent was for the FTE element to be from the 
> authenticator.
>
>> building message 2/4, as well as checks that the handshakes FTE 
>> matches what the 
>
> I'll have to look at how ptk_2_of_4 uses it.  Memory is fuzzy now.  
> Need to open the spec.

All I could find quickly was:

12.7.6.3 4-way handshake message 2

"and that the FTE and MDE are the same as those provided in the AP’s 
(Re)Association Response frame"

So it does appear for EAPoL its the authenticators FTE.

>
>> authenticator sends in 3/4. maybe this is actually a bug in eapol? I 
>> think the reason everything "works" is because the FTE should be the 
>> same between both peers.
>
> Yes, but also we have logic in: netdev_connect_event() that sets the 
> FTE from the response IEs.  So that's probably how things end up 
> working in the end.
>
>>
>> We may want to refactor and do:
>>
>> handshake_state_set_authenticator_fte()
>>
>> handshake_state_set_supplicant_fte()
>
> Yeah, that seems reasonable.
>
> Regards,
> -Denis