Michael MIC Failure Report with RSN?

[Jouni Malinen]

On Fri, Aug 26, 2011 at 05:27:21PM +0200, Helmut Schaa wrote:
> I've got a client connected to hostapd that is sending a Michael MIC
> Failure Report to
> a RSN-only AP after the group key handshake:

What do you mean with "RSN-only"?

> hostapd: wlan0: IEEE 802.11 TKIP countermeasures initiated
> 
> I don't have access to this client but is it really necessary to start
> TKIP countermeasures
> when running in RSN-only mode (which will deauth all associated clients)?

If the station was using TKIP, then any station that is using TKIP
(e.g., as group cipher) needs to be deauthenticated and forced to rekey.
If the BSS does not enable any use of TKIP, it would sound reasonable to
ignore the error reporting part and only rekey the single station that
was incorrectly sending the Request+Error EAPOL-Key frame.

-- 
Jouni Malinen                                            PGP id EFC895FA