Picasso's Fantasy Notepad: WPA3 - SAE

回頭看看自己上一篇的文章記錄 (WPA and WPA2 - TKIP and CCMP Mixed Mode)都已經是2024年六月07日了！足足有一年的時間都沒有記錄心得，其實這些工作心得都寫在自己的記事本當中，只是工作繁忙沒啥時間整理。趁著現在還有一丁點的時間，就拿出來紀錄一下。

WPA3是Wi-Fi Alliance於2018年所發表的技術標準，目前主要的參考文件是：WPA3 Specification Version 3.5 (©2025 Wi-Fi Alliance. All Rights Reserved)。現今業界建議的最低加密標準是WPA2 and WPA3 Mixed Mode。

這裡記錄一下當使用者設定成WPA3 – SAE (Simultaneous Authentication of Equals, 對等實體同步驗證) – CCMP Mode的時候，它的封包內容長什麼樣子。首先，先看一下它的封包流程：

#1044：Beacon Broadcast packet.
#1049：The STA send Probe Request to the AP.
#1050：The AP feedback Probe Response to the STA.
#1055：The STA send Authentication (request, SAE Commit) to the AP.
#1058：The AP feedback Authentication (response, SAE Commit) to the AP.
#1060：The STA send Authentication (request, SAE Confirm) to the AP.
#1063：The AP feedback Authentication (response, SAE Confirm) to the AP.
#1065：The STA send Association Request to the AP.
#1069：The AP feedback Association Response to the STA.

先看一下當使用者設定成WPA3 – SAE – CCMP模式的時候，Beacon封包長成甚麼樣子：

#1044：Beacon Broadcast packet.

Group Cipher Suite OUI / Type: 00:0F:AC (IEEE 802.11) / AES (CCMP, 0x04)
Pairwise Cipher Suite Count: 1
Pairwise Cipher Suite OUI / Type: 00:0F:AC (IEEE 802.11) / AES (CCMP, 0x04)
Auth Key Management (AKM) Suite Count: 1
Auth Key Management (AKM) Suite OUI / Type: 00:0F:AC (IEEE 802.11) / SAE (SHA256, 0x08)
RSN Capabilities:

Management Frame Protection Required: True
Management Frame Protection Capable: True

WPA3規範 IEEE802.11w (PMF, Protected Management Frame)的Required和Capable一定要設定成True；而SAE (SHA256, 0x08)的參考依據則是來自於IEEE 802.11 2020: Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications

接下來我們來觀察一下４組Authentication封包的資訊。

#1055：The STA send Authentication (request, SAE Commit) to the AP.

#1058：The AP feedback Authentication (response, SAE Commit) to the AP.

#1060：The STA send Authentication (request, SAE Confirm) to the AP.

#1063：The AP feedback Authentication (response, SAE Confirm) to the AP.

前面２組Authentication Commit的Authentication SEQ都是0x0001，而後面２組Authentication Confirm的Authentication SEQ都是0x0002。其中Authentication Algorithm: Simultaneous Authentication of Equals (SAE, 0x03)的參考來源如下圖：