aboutsummaryrefslogtreecommitdiffstats
path: root/package
diff options
context:
space:
mode:
authorNick Lowe <nick.lowe@gmail.com>2022-02-21 17:51:48 +0000
committerPaul Spooren <mail@aparcar.org>2022-02-24 18:04:05 +0100
commite8d048c5e0ad0807a0362fe31c68c8f5eb228bff (patch)
tree0f56985f1680061c6ee81bf0fca89301f07f3862 /package
parentfb5d0dc362e5206dbedb694dbe27953582eb887b (diff)
downloadupstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.tar.gz
upstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.tar.bz2
upstream-e8d048c5e0ad0807a0362fe31c68c8f5eb228bff.zip
hostapd: SAE - Enable hunting-and-pecking and H2E
Enable both the hunting-and-pecking loop and hash-to-element mechanisms by default in OpenWRT with SAE. Commercial Wi-Fi solutions increasingly frequently now ship with both hunting-and-pecking and hash-to-element (H2E) enabled by default as this is more secure and more performant than offering hunting-and-pecking alone for H2E capable clients. The hunting and pecking loop mechanism is inherently fragile and prone to timing-based side channels in its design and is more computationally intensive to perform. Hash-to-element (H2E) is its long-term replacement to address these concerns. For clients that only support the hunting-and-pecking loop mechanism, this is still available to use by default. For clients that in addition support, or were to require, the hash-to-element (H2E) mechanism, this is then available for use. Signed-off-by: Nick Lowe <nick.lowe@gmail.com>
Diffstat (limited to 'package')
-rw-r--r--package/network/services/hostapd/files/hostapd.sh2
1 files changed, 2 insertions, 0 deletions
diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
index 157a7ad3e0..f7c21a1513 100644
--- a/package/network/services/hostapd/files/hostapd.sh
+++ b/package/network/services/hostapd/files/hostapd.sh
@@ -620,10 +620,12 @@ hostapd_set_bss_options() {
sae|owe|eap192|eap-eap192)
set_default ieee80211w 2
set_default sae_require_mfp 1
+ set_default sae_pwe 2
;;
psk-sae)
set_default ieee80211w 1
set_default sae_require_mfp 1
+ set_default sae_pwe 2
;;
esac
[ -n "$sae_require_mfp" ] && append bss_conf "sae_require_mfp=$sae_require_mfp" "$N"