Windows 11 Client can't connect to WPA3 Enterprise

[Robert Senger]

Hi all,

I am having trouble getting a Windows 11 client connected to a WPA3
Enterprise network.

While clients using wpa_supplicant can connect fine, the Windows 11
machine fails in early stage. 

When running hostapd with the -d switch from the commmand linbe, I see
this during a connection attempt of the Windows 11 machine: 

association request: STA=04:7b:cb:29:e0:94 capab_info=0x11 listen_interval=1 seq_ctrl=0x1020
Validating WMM IE: OUI 00:50:f2  OUI type 2  OUI sub-type 0  version 1  QoS info 0x0
Unsupported management group cipher 4096

This error occurs always, whatever I set for rsn or group cipher in hostapd.conf

I digged into the sources for that message and found this in
wpa_common.c:

int wpa_cipher_valid_mgmt_group(int cipher)
{
        return cipher == WPA_CIPHER_GTK_NOT_USED ||
                cipher == WPA_CIPHER_AES_128_CMAC ||
                cipher == WPA_CIPHER_BIP_GMAC_128 ||
                cipher == WPA_CIPHER_BIP_GMAC_256 ||
                cipher == WPA_CIPHER_BIP_CMAC_256;
}

which will return 0 for cipher=4096, see defs.h:

#define WPA_CIPHER_NONE BIT(0)
#define WPA_CIPHER_WEP40 BIT(1)
#define WPA_CIPHER_WEP104 BIT(2)
#define WPA_CIPHER_TKIP BIT(3)
#define WPA_CIPHER_CCMP BIT(4)
#define WPA_CIPHER_AES_128_CMAC BIT(5)
#define WPA_CIPHER_GCMP BIT(6)
#define WPA_CIPHER_SMS4 BIT(7)
#define WPA_CIPHER_GCMP_256 BIT(8)
#define WPA_CIPHER_CCMP_256 BIT(9)
#define WPA_CIPHER_BIP_GMAC_128 BIT(11)
#define WPA_CIPHER_BIP_GMAC_256 BIT(12)
#define WPA_CIPHER_BIP_CMAC_256 BIT(13)
#define WPA_CIPHER_GTK_NOT_USED BIT(14)

Maybe I am completely wrong, but 4096 means bit 10, which is not even
assigned to a cipher in defs.h?

What's going on here?

Thank you for help!

Robert

-- 
Robert Senger