[RFC PATCH v2 00/13] SAE: DecoyAuth multiple-password support

[Jeff Hansen]

This series implements DecoyAuth multiple-password authentication for SAE
using H2E, based on Mathy Vanhoef's DecoyAuth work. It retains the
password-only joining workflow while allowing the AP to select policy
based on the authenticated password.

Version 2 also supports SAE Password Identifiers. An identifier selects
an independent candidate set, and DecoyAuth authenticates a password
within that set. For example, tenant-a can have private and guest
passwords under one identifier, while tenant-b has a separate set. A
no-identifier set can coexist. This complements ordinary SAE with
identifiers; it does not conceal an identifier sent in plaintext.

The series includes optional-by-default negotiation, bounded payload
fragmentation in Authentication frames, and password-specific VLAN
retention through PMKSA caching. The first three patches address FT/MLO
integration. Interpolation caching and worker support remain separate
patches and build options. The implementation uses experimental
vendor-specific signaling; it is not a standardized SAE extension.

Changes since v1:
- Rebase onto current hostap main (fcccc8c82e0b).
- Support plaintext password identifiers on AP and station sides, with
  independent named and no-identifier candidate sets. Include the PID
  in uncached H2E derivation, matching the precomputed path.
- Reject unknown identifiers and identifier changes during fragmented
  exchanges without falling back to a different password set.
- Clear rejected, non-accepted infrastructure SAE exchanges so later
  attempts can use another identifier without stale keys or candidates.
- Bound identifier lengths, reject embedded NULs, and normalize empty
  configured identifiers to absent. Opaque replacement identifiers stay
  on the ordinary SAE path in the station implementation.
- Retain the station's pending password after a reflected Commit is
  silently discarded, allowing the valid exchange to continue.
- Remove an unused station-tracking refactor and fix an FT variable
  declaration for configurations without MLO.
- Isolate the OpenSSL-backed cache test from the internal-crypto tests.
  Add hwsim coverage for PID sets, failure recovery, fragmentation,
  configuration limits, compatibility, and reflection recovery.

These changes are folded into the corresponding commits; the series
still contains 13 patches.

Hardware testing of the PID implementation passed 22 checks using two
named sets and one unnamed set, each with two passwords. The checks
covered all six credentials, VLAN and IP connectivity, wrong-password
and wrong-identifier rejection, and recovery without an AP restart or
manual station-state removal. Earlier DecoyAuth testing separately
covered 512-password operation, PMKSA caching, MLO, and FT
interoperability.

I would appreciate feedback on the protocol construction, PID binding,
state-machine handling, and integration approach.

Jeff Hansen (13):
  FT: Add Multi-Link element to Authentication frames
  FT: Update target AP MLO state before response processing
  FT: Include MLO link data in MIC calculation
  crypto: Add DecoyAuth encoding and interpolation support
  crypto: Add DecoyAuth interpolation cache
  SAE: Add DecoyAuth multi-password primitives
  SAE: Add DecoyAuth fragment handling
  SAE: Add DecoyAuth worker support
  hostapd: Add DecoyAuth configuration
  hostapd: Add DecoyAuth SAE responder
  SAE: Preserve password VLAN in PMKSA cache
  wpa_supplicant: Add DecoyAuth SAE initiator
  tests: Add DecoyAuth cache and password identifier coverage

 hostapd/Makefile                      |   13 +
 hostapd/config_file.c                 |   42 +-
 hostapd/defconfig                     |   11 +
 hostapd/hostapd.conf                  |   25 +
 src/ap/ap_config.c                    |   10 +
 src/ap/ap_config.h                    |    3 +
 src/ap/beacon.c                       |    6 +
 src/ap/ieee802_11.c                   |  473 ++++++-
 src/ap/ieee802_11.h                   |    6 +
 src/ap/ieee802_11_eht.c               |    2 +-
 src/ap/pmksa_cache_auth.c             |    1 +
 src/common/sae.c                      | 1815 ++++++++++++++++++++++++-
 src/common/sae.h                      |   68 +
 src/crypto/crypto.h                   |  102 ++
 src/crypto/crypto_openssl.c           | 1306 ++++++++++++++++++
 src/rsn_supp/wpa.c                    |   23 +
 src/rsn_supp/wpa.h                    |   12 +
 src/rsn_supp/wpa_ft.c                 |   95 +-
 tests/Makefile                        |   10 +
 tests/README                          |   23 +
 tests/decoyauth.mk                    |   15 +
 tests/hwsim/test_sae_decoyauth_pid.py |  298 ++++
 tests/test-decoyauth-cache.c          |  179 +++
 wpa_supplicant/Makefile               |    3 +
 wpa_supplicant/config.c               |   19 +
 wpa_supplicant/config_file.c          |    7 +
 wpa_supplicant/config_ssid.h          |    6 +
 wpa_supplicant/defconfig              |    3 +
 wpa_supplicant/sme.c                  |  257 +++-
 wpa_supplicant/wpa_supplicant.c       |    7 +-
 wpa_supplicant/wpa_supplicant.conf    |   12 +
 wpa_supplicant/wpa_supplicant_i.h     |    1 +
 32 files changed, 4784 insertions(+), 69 deletions(-)
 create mode 100644 tests/decoyauth.mk
 create mode 100644 tests/hwsim/test_sae_decoyauth_pid.py
 create mode 100644 tests/test-decoyauth-cache.c


base-commit: fcccc8c82e0b33e348f3f34f3777186c9efc73f5
-- 
2.56.0