Inquiry: Is WPA3-FT Roaming Supported in iwd ver3.9
amit kumar <[email protected]> Tue, 23 Sep 2025 02:53:19 +0530
| Newsgroups | dev.linux.lists.iwd |
|---|---|
| Message-ID | <CAJNKUtceMPq+Yijythto5YW6a3k3B9oxApve4Pss=g2zAdEKhg@mail.gmail.com> |
Dear iwd maintainers and community,
I’m currently working with iwd version 3.9 and have been evaluating
Fast Transition (FT) behavior across different security
configurations with standard Cisco AP (It supports FT roaming).
In my testing:
1> With "WPA2-FT only" security configuration, connection and roaming
works flawlessly — the device connects and roams as expected.
2> WPA3-SAE also connects without an issue.
3> However, when the AP is configured with "WPA3-FT only" (AKM suite
00-0F-AC:9), iwd fails to connect, logging:
iwd[440]: autoconnect: No suitable BSSes found.
4> With the same AP's config, wpa_supplicant is able to connect and roam.
Upon reviewing the source code, I noticed that the AKM suite for FT
over SAE (IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256) is not included in the
logic that identifies WPA3-Personal networks. After adding the
following patch to ie.c, iwd successfully connects to the WPA3-FT AP:
----
diff --git a/src/ie.c b/src/ie.c
--- a/src/ie.c
+++ b/src/ie.c
@@ -1338,7 +1338,8 @@ bool ie_rsne_is_wpa3_personal(const struct
ie_rsn_info *info)
* 3. an AP should enable AKM suite selector: 00-0F-AC:6
* 5. an AP shall set MFPC to 1, MFPR to 0
*/
- if (!(info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256))
+ if (!(info->akm_suites & IE_RSN_AKM_SUITE_SAE_SHA256) &&
+ !(info->akm_suites & IE_RSN_AKM_SUITE_FT_OVER_SAE_SHA256))
return false;
if (!info->mfpc)
----
My query:
Does iwd officially support WPA3-FT roaming? If not, is there a
specific reason this AKM suite is excluded — such as spec maturity,
roaming logic limitations, or security concerns?
I’d appreciate any insights into the roadmap or design considerations
around WPA3-FT support. Happy to share logs or test results if
helpful.
Best regards,
[Amit Kumar]