From a12cec9ea3c8224d6dad7d3b7339e92266f90ef8 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Sun, 19 Apr 2026 20:28:28 +0200 Subject: [PATCH] wifi-scripts: ucode: advertise SAE-EXT-KEY AKM alongside SAE MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit WPA3 Specification v3.5 §2.5.4 mandates that an AP's BSS Configuration enables AKM suite selector 00-0F-AC:24 (SAE-EXT-KEY, SAE with a group-dependent hash) whenever EHT or MLO is enabled. The WPA3 and Wi-Fi Enhanced Open Deployment Guide v1.1 also recommends it on non-EHT APs (Tables 3, 5, 6, 8). Add a new sae_ext_key UCI option (enabled by default) that advertises SAE-EXT-KEY, and FT-SAE-EXT-KEY when 802.11r is enabled, alongside plain SAE/FT-SAE for the sae and psk-sae encryption modes. Co-Authored-By: Claude Opus 4.7 Link: https://github.com/openwrt/openwrt/pull/23009 Signed-off-by: Hauke Mehrtens --- .../usr/share/schema/wireless.wifi-iface.json | 5 +++++ .../files-ucode/usr/share/ucode/wifi/iface.uc | 14 ++++++++++++-- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json index 0d0e64d67b9..97dea0e42dd 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json @@ -962,6 +962,11 @@ "rsn_preauth": { "type": "boolean" }, + "sae_ext_key": { + "description": "Advertise the SAE-EXT-KEY AKM alongside plain SAE. Mandatory for EHT, enabled by default.", + "type": "boolean", + "default": true + }, "sae_password_file": { "description": "External file containing VLAN SAE MAC address triplets", "type": "string" diff --git a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc index 4f718327f06..1f139e3a34e 100644 --- a/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc +++ b/package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc @@ -148,14 +148,24 @@ export function wpa_key_mgmt(config) { case 'sae': append_value(config, 'wpa_key_mgmt', 'SAE'); - if (config.ieee80211r) + if (config.sae_ext_key) + append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY'); + if (config.ieee80211r) { append_value(config, 'wpa_key_mgmt', 'FT-SAE'); + if (config.sae_ext_key) + append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY'); + } break; case 'psk-sae': append_value(config, 'wpa_key_mgmt', 'SAE'); - if (config.ieee80211r) + if (config.sae_ext_key) + append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY'); + if (config.ieee80211r) { append_value(config, 'wpa_key_mgmt', 'FT-SAE'); + if (config.sae_ext_key) + append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY'); + } append_value(config, 'wpa_key_mgmt', 'WPA-PSK'); if (config.ieee80211w) -- 2.47.3