On Thu, Oct 05, 2006 at 09:13:53AM -0400, Stuffed Crust wrote: > (Leave out the RSNIE, AuthType and KeyMgmt stuff; while they're > used in the actual key negotiation/derivation, they're separate > problems and have no bearing on the crypto layer. From the driver's > perspective the RSNIE is just an opaque blob to be appended to > beacons,presps and [re]assoc frames, KeyMgmt is purely a matter for > the authenticator/supplicant, and AuthType is just a toggle that > happens to be off for post-802.11i, although LEAP v1 adds some > complications there..)
They are separate problems, but they do need to be taken into account in 802.11 interface to user space. Some drivers generate WPA/RSN IE internally and they need to be told about the allowed protocol version, authenticated key management suite, and pairwise/group cipher suites. In other words, key management is not purely for authenticator/supplicant. > Each key has: > > * Key type (WEP/TKIP/AES-CCMP/NONE) > * Key length (implied, but WEP can have varying key lengths) > * Key index (only '0' is generally used for unicast frames, but 802.11i > requires use of simultaneous broadcast keys) Pre-802.11i supported key mapping and multiple default keys.. To make things complex, many Cisco APs are configured to use non-zero key indexes with dynamic WEP keys.. > ...Meanwhile. It's foolish to ignore the 802.11 MLME. It lists out > pretty much everything that's necessary to get a working connection, and > looking at its evolution (and changes in the pipeline) shows that it's > impossible to do it all (right) the first time, and that changes, not > just additions, will be necessary. There are non-standard WLAN security protocols (look at Cisco) and one needs to keep in mind that just looking at 802.11 MLME may not cover all cases that, in practice, have to be supported.. Anyway, I agree that MLME primitives do change and there will be new commands needed to cover needs of future amendments to 802.11 (see, e.g., 802.11r and 802.11w drafts). -- Jouni Malinen PGP id EFC895FA - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
