[STDS-802-11-TGM] DecoyAuth for TGmf (r1)
--- This message came from the IEEE 802.11 Task Group M Technical Reflector ---
Hello all,
Following my TGmf presentation, I’ve updated the DecoyAuth changeset to include support for Password Identifiers. I’d appreciate another technical look. I’ve also submitted my patches for DecoyAuth support (v2) to the hostap mailing list with a fully tested implementation.
I don’t think this needs to be an either/or choice between DecoyAuth and Password Identifiers. There are three useful deployment options:
1. DecoyAuth without a Password Identifier: Restore PPSK/MPSK-style functionality with multiple passwords on one SSID, retaining the familiar password-only joining experience. This requires DecoyAuth support on both the AP and STA.
2. Ordinary SAE with Password Identifiers: Address some of the same deployment needs using separate identifier/password combinations. However, requiring users to supply both is a substantial change from today’s PPSK/MPSK experience, unless provisioning tools handle the identifier for them.
3. Password Identifiers combined with DecoyAuth: Give tenant A one identifier with two passwords, perhaps one for their own devices and another for guests, with different VLANs or policies. Tenant B can have their own identifier and passwords. A separate password-only set can coexist on the same SSID.
The combined approach lets the identifier select the tenant’s password set, while successful authentication with a particular password determines the applicable policy. It does not make the identifier itself secret.
Updated changeset: https://mentor.ieee.org/802.11/dcn/26/11-26-1982-01-000m-decoyauth-changeset.docx
Could people review the cryptographic construction, identifier binding, and coexistence with ordinary SAE? If there are technical blockers or missing normative requirements, I’d appreciate specific feedback so we can address them.
Thank you,
Jeff Hansen
Alta Labs
_______________________________________________________________________________
IF YOU WISH to be Removed from this reflector, PLEASE DO NOT send your request to this
CLOSED reflector. We use this valuable tool to communicate on the issues at hand.
SELF SERVICE OPTION:
Point your Browser to - http://listserv.ieee.org/cgi-bin/wa?SUBED1=STDS-802-11-TGM and
then amend your subscription on the form provided. If you require removal from the reflector
press the LEAVE button.
Further information can be found at: http://www.ieee802.org/11/Email_Subscribe.html
_______________________________________________________________________________