[PATCH] wpa_supplicant: Don't prefer SAE over PSK without a passphrase

[Jouni Malinen]

On Mon, Sep 28, 2026 at 03:51:57PM +0100, Phil Elwell wrote:
> SAE (WPA3) requires a passphrase (or an explicit sae_password) in
> order to derive the password element used in the handshake - a raw
> PSK, as stored for a network profile that only has a 64-hex-digit PSK
> configured, cannot be used with SAE.
> 
> For a network profile whose key_mgmt allows both WPA-PSK and SAE
> (e.g. connecting to an AP running in WPA2/WPA3 transition mode), the
> key management selection logic always preferred SAE when the driver
> and AP both support it, regardless of whether the network profile
> actually has a passphrase available. If credentials for such a
> network were stored as a raw PSK rather than a passphrase (as
> happens when a PSK is provided in hex form, e.g. by some device
> provisioning flows), this caused the SAE key derivation to fail and
> the connection to be rejected, even though falling back to WPA2-PSK
> would have worked with the stored PSK.
> 
> Only prefer SAE if the profile has a passphrase or an explicit SAE
> password configured; otherwise mask out SAE/FT-SAE from the
> candidate key_mgmt set so that PSK/FT-PSK can be selected instead.

It feels a bit strange to describe this as preferring SAE when the
change here is really to just completely disable SAE.

> diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
> @@ -1538,6 +1538,11 @@ static int wpa_supplicant_set_suites(struct
> wpa_supplicant *wpa_s,
>  #ifdef CONFIG_SAE
>   if (!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_SAE))
>   sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
> + if (!ssid->sae_password && !ssid->passphrase) {
> + wpa_dbg(wpa_s, MSG_DEBUG,
> + "WPA: No SAE password/passphrase available; not preferring SAE/FT-SAE");
> + sel &= ~(WPA_KEY_MGMT_SAE | WPA_KEY_MGMT_FT_SAE);
> + }
>  #endif /* CONFIG_SAE */

This is whitespace damaged, but even if I were to fix that manually,
this does not seem to match any recent version.. What is the baseline
used for this patch? The current hostap.git snapshot has quite a bit
extended functionality in this location with support for SAE offload and
the new SAE-EXT-KEY AKMs. In addition, there is a call to
wpas_is_sae_avoided() and that would likely be a better place for
checking this condition for SAE password not being available.

-- 
Jouni Malinen                                            PGP id EFC895FA