WPA3 experiment

Technical Support for Routers
1

Comments welcome!

I have just flashed a copy of openwrt 19.07 to my GL-USB150 router. I replaced wpad-basic with wpad-openssl and found that I could set the wireless security to wpa3-sae.

I successfully connected my laptop running Windows 10 1909 and got internet access. I am very pleased with this.

I usually run ubuntu on the laptop, but this I couldn’t get it to connect. I suspect the DKMS driver for the rtl8821CE wireless chip because it wouldn’t connect when PMF (protected management frames) was switched on in the router.

The GL-USB150 uses the Ath9k driver for the Qualcomm QCA9331.

Has anyone else tried WPA3 yet?

T

2

Its looks for me about the follow:

  • I got a hand of Intel AX200 wifi cards for peoples around me
  • addet the new kernel driver by cp iwlwifi-*.ucode /lib/firmware to Linux
  • now i have to figure out how to make the kernel driver known the system by „/etc/modprobe.d“ or what ever
  • a hand of people around waiting for update of gl router to OpenWrt 19.07.1 - First Service Release - 31 January 2020
  • a other hand of people use already WPA3 supporting AVM routers with WPA3 supporting win10 pc`s
3

A further finding - OWE (Opportunistic Wireless Encryption) didn’t seem to work. I am not sure if this is the router or the client.

@Henry_Bruns I am looking forward to my Nokia phone updating to Android 10 soon (in the next month)

1 Like
4

Its time to replace non WPA3 by WPA3 class firmware and if available the non WiFi6 by WiFi6 hardware.

1 Like
5

Adding to the list of WPA3 Capable Devices

IOS 13 - any device capable of running IOS 13, can support WPA3
MacOS 10.15 - any Mac with WiFi 5 (802.11ac) supports WPA3, older Macs that support 802.11n do not

6

Thanks for the information.

7

I tried repeating this experiment and the results showed me that openwrt does not seem to set up wpa3 without switching off the wireless. When I tried rebooting the USB150 router, to reset the wireless, openwrt reverted to wpa2, so I am afraid the outcome was not what I thought. The same happened with PMF (protected management frames) . I searched the specification of the QCA9331 and there was no mention of PMF or 802.11w (the same thing). So, it does not look as if the USB150 will be able to cope with wpa3.

8

Blockquote

WPA3 support

The 19.07 release brings initial support for WPA3. However, WPA3 is not enabled by default and requires installing specific packages: to run WPA3 as an access point, hostapd-openssl is needed. For use as a Wi-Fi station, you need either wpa-supplicant-openssl (station support only) or wpad-openssl (AP + station). Due to their large size, these packages are not installed by default, and it is impossible to install them on devices with less than 8MB flash.

It should also be noted that many existing client devices will never support WPA3, and that there are client devices that support WPA2 but cannot connect to an AP configured with WPA2+WPA3 mixed mode. Please only file bugs if you are sure the problem is not client related.

To configure your device as a WPA3 access point, see wpa_modes

Blockquote

Source: [OpenWrt Wiki] OpenWrt 19.07.2 - Service Release - 6 March 2020

It can be its related on this, a I am not a programmer.

9

I did install wpad-openssl but I think it was due to the hardware not supporting 802.11w (Protected Management Frames). The Openwrt silently returned to wpa2 on reboot, and did not use the new wpa3, leading me astray. I now doubt if this device (USB150) will ever be able to support wpa3.

Here is a link that explains a bit about PMF or MFP or 802.11w for those who may be a bit confused.
(Caution: it is a bit complicated…)

https://gigawave.com/2016/05/10/techtip-802-11w-protected-management-frames/

10

Most work on OpenWRT 19.07 and later for advanced features is being on the ath79 branch for usb150 and ar150

gl-inet FW is still on ar71xx - moving to ath79 is non-trivial for gl-inet’s software.