diff options
| author | Nick Lowe <nick.lowe@gmail.com> | 2022-02-21 17:51:48 +0000 |
|---|---|---|
| committer | Paul Spooren <mail@aparcar.org> | 2022-02-24 18:04:05 +0100 |
| commit | e8d048c5e0ad0807a0362fe31c68c8f5eb228bff (patch) | |
| tree | 0f56985f1680061c6ee81bf0fca89301f07f3862 /package/network/services/hostapd/files | |
| parent | fb5d0dc362e5206dbedb694dbe27953582eb887b (diff) | |
| download | upstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.tar.gz upstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.tar.bz2 upstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.zip | |
hostapd: SAE - Enable hunting-and-pecking and H2E
Enable both the hunting-and-pecking loop and hash-to-element mechanisms
by default in OpenWRT with SAE.
Commercial Wi-Fi solutions increasingly frequently now ship with both
hunting-and-pecking and hash-to-element (H2E) enabled by default as this
is more secure and more performant than offering hunting-and-pecking
alone for H2E capable clients.
The hunting and pecking loop mechanism is inherently fragile and prone to
timing-based side channels in its design and is more computationally
intensive to perform. Hash-to-element (H2E) is its long-term
replacement to address these concerns.
For clients that only support the hunting-and-pecking loop mechanism,
this is still available to use by default.
For clients that in addition support, or were to require, the
hash-to-element (H2E) mechanism, this is then available for use.
Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
Diffstat (limited to 'package/network/services/hostapd/files')
| -rw-r--r-- | package/network/services/hostapd/files/hostapd.sh | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh index 157a7ad3e0..f7c21a1513 100644 --- a/package/network/services/hostapd/files/hostapd.sh +++ b/package/network/services/hostapd/files/hostapd.sh @@ -620,10 +620,12 @@ hostapd_set_bss_options() { sae|owe|eap192|eap-eap192) set_default ieee80211w 2 set_default sae_require_mfp 1 + set_default sae_pwe 2 ;; psk-sae) set_default ieee80211w 1 set_default sae_require_mfp 1 + set_default sae_pwe 2 ;; esac [ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N" |