Re: AW: [PATCH] gsupplicant: MFP optional for WPA2-Personal

Hi Sven,

On 5/13/25 6:42 AM, Dembianny Sven (BSH GDE-EDSD7) wrote:
> Hi Denis,
> 
>> -----Ursprüngliche Nachricht-----
>> Von: Denis Kenzior <[email protected]>
>> Gesendet: Montag, 12. Mai 2025 21:22
>> An: Michael Trimarchi <[email protected]>; [email protected]
>> Cc: [email protected]; Dembianny Sven (BSH GDE-EDSD7)
>> <[email protected]>
>> Betreff: Re: [PATCH] gsupplicant: MFP optional for WPA2-Personal
>>
>> Hi Michael,
>>
>> On 5/12/25 3:52 AM, Michael Trimarchi wrote:
>>> From: "Dembianny, Sven (GDE-EDSD5)" <[email protected]>
>>>
>>> Previous MFP support was restricted to WPA3, however it is also
>>> possible to set MFP to mandatory on APs with WPA2.
>>
>> Yes, assuming your device supports it.  But I'm not quite sure how this description corresponds to the
>> actual patch?  It looks like the intent is to always set ieee80211w=1 (MFP Capable set, MFP Required
>> not set) which enables the use of MFP by wpa_supplicant even on WPA2 networks.
>>
> Yes, MFPC hast to be set always also on WPA2 networks in terms of security requirements by WFA, independent from AP configuration.
> See "Wi-Fi CERTIFIED Protected Management Frames Test Plan v1.9.pdf", 3.3.2 "STAUT requirements".

Okay, thanks for confirming that this is indeed about setting MFPC.  When I read 
the original, the verbiage '... set MFP to mandatory ...' made me think that 
MFPR was somehow involved.  Lets make this clearer in the commit description for v2.

>>>
>>> wpa_supplicant config:
>>>
>>> * WPA2-Personal: key_mgmt="WPA-PSK-SHA256" ; iee80211w=1
>>>
>>> It is important that the default value of MFPC bit is 1 on the final-commercial
>>> version of the device. It is a mandatory WFA requirement.
>>
>> Which 'device'?  I think you may be referring to something specific to your use
>> case here.
>>
> See above statement, "device" was referring to any device under test for current WFA certification.

Okay, thanks for that explanation.  Makes sense now.  For the next version's 
commit description, could you make it clearer that you're quoting an external 
document?

Also, have you checked that wpa_supplicant will accept 'ieee80211w=1' for legacy 
devices that do not support MFP at all?

Regards,
-Denis