Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Subject: Re: PRO/Wireless 2200BG Intel WPA3 SSID connection problem #1
From:   Marcel Holtmann <marcel@holtmann.org>
In-Reply-To: <CADUzMVbgf2dcu0yM=XO37GbTvgGK=mJpfELHrqDqbBECSuLKJg@mail.gmail.com>
Date:   Mon, 28 Nov 2022 10:56:12 +0100
Cc:     linux-wireless@vger.kernel.org
Content-Transfer-Encoding: 7bit
Message-Id: <3898EA13-74B9-43DD-960A-44FDF6BAE007@holtmann.org>
References: <CADUzMVbgf2dcu0yM=XO37GbTvgGK=mJpfELHrqDqbBECSuLKJg@mail.gmail.com>
To:     Ioannis Barkas <jnyb.de@gmail.com>
Precedence: bulk

Hi Ioannis,

>> Well, keep in mind that WPA3 requires all kinds of new things, and the
>> *most recent* NIC you tried is already ~11 years old afaict.
> Yes and no. Yes it needs new things. No this is not the case here. I
> tested cards from 2021 back to 2003.
> 
>> This probably means they use SW crypto for everything.
> Sounds good to me since it works.
> 
>> What makes you believe that?
> The fact that some just work. Why not use SW crypto on legacy devices?
> 
>> Umm, no? Why would we break NICs that work well with most existing
>> networks, just not WPA3 ones?
> You got it wrong here. What I mean is to use a flag that some devices
> are not WPA3 compatible. That way when an attempt to connect at such
> an SSID would print a message suggesting to use a WPA2 network. This
> will help novice users and save time from bug reports. Most routers
> now support WPA3.

have you tried iwd instead of wpa_supplicant? I think we have taken care
of ensuring that WPA3 (or more precise SAE) is only tried when all
ciphers are correctly supported by the card. Otherwise it is going to
stick with WPA2. In case of WPA3-only network, we will have to see
what happens and if the error reported is correct.

You can try iwd behind NM or standalone with iwctl command line client
and it will also give you iwmon tracing tool that allows more capturing
the nl80211 traffic.

Regards

Marcel