After two and a half years of development, the release of hostapd/wpa_supplicant 2.11 has been announced, a suite for the operation of wireless protocols IEEE 802.1X, WPA, WPA2, WPA3, and EAP. The suite includes the wpa_supplicant application for connecting to a wireless network as a client and the hostapd background process for functioning as an access point and authentication server, incorporating components such as the WPA Authenticator, RADIUS authentication client/server, and EAP server. The source code for the project is distributed under the BSD license.
Key changes in the new releases of hostapd and wpa_supplicant:
- Initial support for Wi-Fi 7 (EHT/IEEE 802.11be) has been added, along with improved support for Wi-Fi 6 (HE/IEEE 802.11ax).
- Support for the third version of the DPP (Device Provisioning Protocol), commonly referred to as "Wi-Fi Easy Connect," has been added, along with the ability to transmit parameters with Wi-Fi settings using DPP. The DPP protocol enables simplified configuration of wireless devices without a screen interface by using another more advanced device that is already connected to the wireless network. DPP is based on the use of public key authentication; for example, settings for a screenless IoT device can be provided from a smartphone based on a QR code printed on the device that encodes the public key.
- Support for API changes proposed in the OpenSSL 3.0 cryptographic library branch has been added.
- In the implementation of the EAP-SIM (Extensible Authentication Protocol — Subscriber Identity Module) and EAP-AKA (Extensible Authentication Protocol — Authentication and Key Agreement) authentication protocols, support for a mechanism that ensures the privacy of the mobile network subscriber identifier has been added, preventing the disclosure of the IMSI when connecting to the access point.
- Support for SAE AKM (Simultaneous Authentication of Equals — Authentication and Key Management) operating modes with variable key sizes has been added.
- Added support for an AKM (Authentication and Key Management) variant based on SHA384 hashes.
- In the implementation of the PASN (Pre Association Security Negotiation) mechanism, used to establish a secure connection and protect the exchange of management frames at the early stage of connection, support for "secure ranging" technology for safely determining the distance between two Wi-Fi devices has been provided.
- Support for the USD (Unsynchronized Service Discovery) mechanism has been added, simplifying service discovery by wireless devices.
- Support for explicit SSID protection during a four-step connection negotiation has been added. Protection is enabled using the option ‘ssid_protection=1’ and blocks the CVE-2023-52424 vulnerability, which allows connections to a less secure wireless network.
- Changes specific to hostapd:
- Support for background interference detection from radar systems operating in the same frequency bands has been added (frequency switching occurs upon detection). Support for the CAC (Channel Availability Check) mechanism has also been added, designed to listen to the channel before use to verify its occupancy by the radar system.
- The SAE (Simultaneous Authentication of Equals) connection negotiation method now has the ability to request passwords from the RADIUS server.
- Support for ACL (Access-Control List) checks and PSK (Pre-Shared Key) using the RADIUS protocol during connection negotiation (wpa_psk_radius=3) has been added.
- In the ACS (Automatic Channel Selection) mechanism implementation, the selection of the channel to be used takes into account the bandwidth and types of channels.
- Support for multiple BSSID (Basic Service Set Identifier) identifiers on a single access point has been expanded to enable virtual wireless networks.
- Initial support for using TLS for encrypting RADIUS protocol requests has been added.
- Changes specific to wpa_supplicant:
- In the implementation of the MACsec (IEEE 802.1AE) standard, which provides means to protect the data transmission channel, the use of the GCM-AES-256 cipher suite has been enabled, and support for hardware acceleration through offloading operations to the network adapter has been added.
- Support for TLSv1.3 has been improved for EAP-TLS.
- Protection against DoS attacks using PMF (Protected Management Frames) has been enhanced.
- Roaming between AKM (Authentication and Key Management) has been improved when selecting SME/BSS (Service Management Entity/Basic Service Set) by the driver.
- The mechanism PASN (Protected Access Secure Negotiation) can now be used with external programs.
- Support for using pre-generated MAC addresses (mac_addr=3) instead of generating a random MAC for each network has been added.
- The use of second-phase authentication (phase2_auth=1) for the EAP-PEAP protocol is enabled by default, which involves client authentication within a secure tunnel.
- Expanded support for MSCS (Multi-Streaming Channel Switching) technology, allowing the device to switch between multiple channels.
- Expanded support for SCS (Spatial Channel Switching) technology prioritizing the processing of important traffic when using QoS.
Source: opennet.ru
