Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CALjTZvbLOr5zAYyp75Cs6Zo8mWNUVq3ZRJu56G1iHdiihFejWQ@mail.gmail.com>
 <3483242e-c2ad-ec83-0c2c-ce952bc9b638@lwfinger.net> <CALjTZvatxQ2BvUeZGcTFijBf1PiLizJuDdENxg2b=tPQL_NAzQ@mail.gmail.com>
 <CALjTZvYSJOx0xeMVkN6dHcGTdgW9O9NVbgXPKK4d6-31VX+0JQ@mail.gmail.com>
 <29f5e3de-a32c-6292-9197-19dcc57fa6a3@lwfinger.net> <CALjTZvaroTrgK9=W8uTwq9YcYayfuEU31BUc0qNYJr+08hevfg@mail.gmail.com>
 <CALjTZvaPi2FL-epk-Vd2wOLye2O0J8G5aZPsqzHXt2b7u=HyuQ@mail.gmail.com>
 <263e247c-3bf9-6d42-996b-bc513efe4b71@lwfinger.net> <CALjTZvauK0Hh+aoabcDX9kkQZ4zN2ZjPnB+aq7YrJ9+-4ihiAg@mail.gmail.com>
 <87fffd5d-242a-7195-c4cc-80260dbd53c5@lwfinger.net>
In-Reply-To: <87fffd5d-242a-7195-c4cc-80260dbd53c5@lwfinger.net>
From:   Rui Salvaterra <rsalvaterra@gmail.com>
Date:   Thu, 21 May 2020 09:35:58 +0100
Message-ID: <CALjTZvYCFNSQ6HMN4owkiGTVrYaiU8R-P1KXgvkwGqcOo8uMuw@mail.gmail.com>
Subject: Re: [BUG?] b43: can't connect to WPA3 network (nohwcrypt=1)
To:     Larry Finger <Larry.Finger@lwfinger.net>
Cc:     linux-wireless@vger.kernel.org, b43-dev@lists.infradead.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Hi, Larry,

On Wed, 20 May 2020 at 21:56, Larry Finger <Larry.Finger@lwfinger.net> wrot=
e:
>
> A quick difference - this one supports 3 additional ciphers:
>
> vedder wpa_supplicant[376]: nl80211: Supported cipher 00-0f-ac:13
> vedder wpa_supplicant[376]: nl80211: Supported cipher 00-0f-ac:11
> vedder wpa_supplicant[376]: nl80211: Supported cipher 00-0f-ac:12

Well, yes, I wrote exactly that in the first email. :) But notice
there's another cypher missing from that list=E2=80=A6

vedder wpa_supplicant[376]: nl80211: Supported cipher 00-0f-ac:6

=E2=80=A6 which is CMAC.

> The one with :13 is for  BIP-CMAC-256, :11 is BIP-GMAC-128, and :12 is
> BIP-GMAC-256. I did not find a reference that says that these are needed =
for
> WPA3, but I am suspicious.

Actually, I've been digging around in my other machines, and I noticed
that an Intel card I have, which has no problems connecting to my WPA3
AP, supports a much narrower variety of cyphers. According to iw list,
its supported cyphers are:

        * WEP40 (00-0f-ac:1)
        * WEP104 (00-0f-ac:5)
        * TKIP (00-0f-ac:2)
        * CCMP-128 (00-0f-ac:4)
        * CMAC (00-0f-ac:6)

So, the only extra cypher it supports is CMAC. Digging around the web,
I found this [1] blog post, which does seem to imlpy CMAC is necessary
for the group cypher. Additionally, there's this line in the second
log I sent you (with the successful authentication):

vedder wpa_supplicant[376]: WPA: EAPOL-Key MIC using AES-CMAC
(AKM-defined - SAE)

My conclusion is that CMAC mode is required for WPA3 Personal. What
strikes me as odd is b43 not supporting any additional cyphers in
software crypto mode.
With that said, I'm going to try your patch, but I'm 95 % confident
the result will be the same.

Thanks,
Rui

[1] https://mrncciew.com/2019/11/29/wpa3-sae-mode/