The shitheads at Apple and Google finally got their act together and published a...

Still doesn't mention that the value being fed to the KDF is the _DECRYPTED_ identity, which breaks RFC 4187, which states the AT_IDENTITY value is used by the KDF.  It's telling that no one of the ~40 contributors from ~20 different organisations caught this omission.

diff --git a/share/dictionary/eap/aka-sim/dictionary b/share/dictionary/eap/aka-sim/dictionary
index 992b139c1dbca76adf05076cc7529b05608e28e4..f05c356b2884f549c659012c716bbd0d680fb900 100644 (file)
--- a/share/dictionary/eap/aka-sim/dictionary
+++ b/share/dictionary/eap/aka-sim/dictionary
@@ -15,5 +15,6 @@ $INCLUDE dictionary.rfc5448
 $INCLUDE dictionary.rfc7458
 $INCLUDE dictionary.3gpp-ts24.139
 $INCLUDE dictionary.3gpp-ts24.302
+$INCLUDE dictionary.wba-imsi-private-protection-for-wifi
 
 END-PROTOCOL   EAP-AKA-SIM

diff --git a/share/dictionary/eap/aka-sim/dictionary.wba-imsi-private-protection-for-wifi b/share/dictionary/eap/aka-sim/dictionary.wba-imsi-private-protection-for-wifi
new file mode 100644 (file)
index 0000000..f953ab5
--- /dev/null
+++ b/share/dictionary/eap/aka-sim/dictionary.wba-imsi-private-protection-for-wifi
@@ -0,0 +1,10 @@
+# -*- text -*-
+# Copyright (C) 2021 The FreeRADIUS Server project and contributors
+# This work is licensed under CC-BY version 4.0 https://creativecommons.org/licenses/by/4.0
+# Version $Id$
+#
+#      Values defined by WBA IMSI Privacy Protection for Wi-Fi - Technical Specification v1.0.
+#
+#      https://wballiance.com/wp-content/uploads/2021/02/IMSI-Privacy-Protection-for-Wi-Fi-Technical-Specification-v1.0-PMO.pdf
+#
+VALUE  Notification                    Certificate-Replacement-Required        16385