[RFC PATCH v1 00/13] SAE DecoyAuth multi-password authentication with FT/MLO support

[Jeff Hansen]

Jouni,

Thanks for the feedback. I agree that station OS vendor interest and standardization are important.

My understanding was that password identifiers were intended to address this gap in WPA3-SAE. From my perspective, they still leave a couple of challenges for this use case:
1. Password identifiers are still sent in the clear for the first connection, so the identity is not anonymous. Even with the PID encryption enhancements, my understanding is that a rogue AP can force the client to divulge the clear-text PID again.
2. It's a different user experience from the existing PPSK/MPSK solution, especially for MDUs. There is no backward compatibility, and station OS vendors appear hesitant to add another field for joining a network.

There is considerable interest from MDU managed-Wi-Fi operators: https://www.linkedin.com/feed/update/urn:li:activity:7282773188655095809/ That interest may not be well represented in IEEE conversations yet.

I know of MSPs that are not installing 6 GHz, or are disabling it for the time being, because of this gap in WPA3-SAE.

I'll be presenting to TGmf next week to work toward a path for integration into the 802.11 spec, as you've suggested.

Would feedback from those operators help demonstrate deployment interest? I recognize that station OS vendor support is a separate piece we still need to establish.

-Jeff

> On Oct 2, 2026, at 8:04 AM, Jouni Malinen <j at w1.fi> wrote:
> 
> On Fri, Sep 11, 2026 at 07:20:00PM +0000, Jeff Hansen wrote:
>> This adds multiple password support to WPA3-SAE through Mathy Vanhoef's
>> work via an NGI Sargasso grant. More details can be found here:
>> https://github.com/DistriNet/decoyauth
>> 
>> This includes both AP- and Client-side changes, and has been tested
>> thoroughly by Alta Labs. AP7-Pro version 3.0m includes this port,
>> and has been verified as well.
> 
> While this is interesting from theoretical view point, I'm not sure
> there is much point in applying this into hostap.git without there first
> being some clear signs of real deployment interest especially from main
> station operating system vendors and standardization effort through IEEE
> 802.11 or Wi-Fi Alliance.
> 
> -- 
> Jouni Malinen                                            PGP id EFC895FA