{"id":118137,"date":"2024-07-23T15:43:01","date_gmt":"2024-07-23T13:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-hostapd-i-wpa_supplicant-2-11-realizaczii-steka-besprovodnyh-protokolov"},"modified":"2024-07-23T15:43:01","modified_gmt":"2024-07-23T13:43:01","slug":"vypusk-hostapd-i-wpa_supplicant-2-11-realizaczii-steka-besprovodnyh-protokolov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-hostapd-i-wpa_supplicant-2-11-realizaczii-steka-besprovodnyh-protokolov","title":{"rendered":"Release of hostapd and wpa_supplicant 2.11, implementations of the wireless protocol stack","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
After two and a half years of development, the release of hostapd\/wpa_supplicant 2.11 has been announced, a suite for the operation of wireless protocols IEEE 802.1X, WPA, WPA2, WPA3, and EAP. The suite includes the wpa_supplicant application for connecting to a wireless network as a client and the hostapd background process for functioning as an access point and authentication server, incorporating components such as the WPA Authenticator, RADIUS authentication client\/server, and EAP server. The source code for the project is distributed under the BSD license. <\/p>\n
Key changes in the new releases of hostapd and wpa_supplicant: <\/p>\n
\n
Initial support for Wi-Fi 7 (EHT\/IEEE 802.11be) has been added, along with improved support for Wi-Fi 6 (HE\/IEEE 802.11ax).\n
Support for the third version of the Device Provisioning Protocol (DPP), commonly known as 'Wi-Fi Easy Connect', has been added, along with the ability to transfer Wi-Fi setup parameters using DPP. The DPP protocol facilitates the simplified configuration of wireless devices without a screen interface, by using another advanced device already connected to the wireless network. DPP is based on public key authentication, allowing configuration parameters for screenless IoT devices to be set from a smartphone via a QR code printed on the device housing that encodes the public key.\n
Support for API changes proposed in the OpenSSL 3.0 cryptographic library branch has been added.\n
In the implementation of the EAP-SIM (Extensible Authentication Protocol \u2014 Subscriber Identity Module) and EAP-AKA (Extensible Authentication Protocol \u2014 Authentication and Key Agreement) authentication protocols, support has been introduced for a privacy mechanism that prevents the disclosure of the mobile network subscriber's identifier, excluding the IMSI during connection to the access point.\n
Support has been added for SAE AKM (Simultaneous Authentication of Equals \u2014 Authentication and Key Management) operating modes with variable key sizes.\n
Added support for an AKM (Authentication and Key Management) variant based on SHA384 hashes.\n
In the implementation of the PASN (Pre Association Security Negotiation) mechanism, used to establish a secure connection and protect control frame exchanges at the early stage of connection, support for 'secure ranging' technology has been provided to safely determine the distance between two Wi-Fi devices.\n
Support for the USD (Unsynchronized Service Discovery) mechanism has been added, simplifying service discovery by wireless devices.\n
Support for explicit SSID protection has been added during a four-stage connection negotiation. Protection is enabled via the 'ssid_protection=1' option and mitigates the CVE-2023-52424 vulnerability that allows connecting to a less secure wireless network.\n
Changes specific to hostapd:\n
\n
Support for background interference detection from radar systems operating in the same frequency bands has been added (frequency switching occurs upon detection). Support for the CAC (Channel Availability Check) mechanism has also been added, designed to listen to the channel before use to verify its occupancy by the radar system.\n
The SAE (Simultaneous Authentication of Equals) connection negotiation method now has the ability to request passwords from the RADIUS server.\n
Support for ACL (Access-Control List) checks and PSK (Pre-Shared Key) using the RADIUS protocol during connection negotiation (wpa_psk_radius=3) has been added.\n
In the ACS (Automatic Channel Selection) mechanism implementation, the selection of the channel to be used takes into account the bandwidth and types of channels.\n
Support for multiple BSSID (Basic Service Set Identifier) identifiers on a single access point has been expanded to enable virtual wireless networks.\n
Initial support for using TLS for encrypting RADIUS protocol requests has been added. <\/ul>\n
Changes specific to wpa_supplicant:\n
\n
In the implementation of the MACsec (IEEE 802.1AE) standard, which provides means to protect the data transmission channel, the use of the GCM-AES-256 cipher suite has been enabled, and support for hardware acceleration through offloading operations to the network adapter has been added.\n
Support for TLSv1.3 has been improved for EAP-TLS.\n
Protection against DoS attacks using PMF (Protected Management Frames) has been enhanced.\n
Roaming between AKM (Authentication and Key Management) has been improved when selecting SME\/BSS (Service Management Entity\/Basic Service Set) by the driver.\n
The mechanism PASN (Protected Access Secure Negotiation) can now be used with external programs.\n
Support for using pre-generated MAC addresses (mac_addr=3) instead of generating a random MAC for each network has been added.\n
The use of second-phase authentication (phase2_auth=1) for the EAP-PEAP protocol is enabled by default, which involves client authentication within a secure tunnel.\n
Expanded support for MSCS (Multi-Streaming Channel Switching) technology, allowing the device to switch between multiple channels.\n
Expanded support for SCS (Spatial Channel Switching) technology prioritizing the processing of important traffic when using QoS. <\/ul>\n<\/ul>\n