| PMKSA Cache | IEEE 802.11-2020
§12.7.1.3 | PMK Security Association (PMKSA) caches the derived PMK after a successful 802.1X exchange. On re-association to the SAME AP, the STA presents the PMKID in RSN IE of Assoc Req. If AP finds a matching PMKSA, it skips full EAP and goes directly to 4-way handshake. | PMKSA = {PMKID, PMK, AA, SPA, expiry}
PMKID = HMAC-SHA1-128(PMK, 'PMK Name' || AA || SPA)
Lifetime: dot11RSNAConfigPMKLifetime (default 43200 s = 12h)
Max entries: dot11RSNAConfigPMKCacheSize | RSN IE in Assoc Req: wlan.rsn.ie.pmkid present
PMKID length = 16 bytes
Zero PMKID count = no cache (full EAP required) |
| OKC - Opportunistic Key Caching | IEEE 802.11-2020
§12.7.1.4 | OKC allows STA to reuse a PMK from one AP to derive a PMKID for a NEIGHBORING AP (same RADIUS/WLC). STA computes PMKID using its PMK + target AP MAC. No 802.11r required. Less efficient than FT but widely deployed. | PMKID = HMAC-SHA1-128(PMK, 'PMK Name' || Target_AP_BSSID || STA_MAC)
Same PMK used as for original AP. WLC/RADIUS must share PMK with all APs in ESS. | RSN IE in Assoc Req to new AP: wlan.rsn.ie.pmkid matches OKC-derived value. AP validates PMKID against its cached PMK for this STA. |
| ERP - EAP Re-auth Protocol | RFC 6696
IEEE 802.11-2020 | ERP enables fast re-authentication across AP boundaries without a full EAP exchange. After initial EAP success, re-authentication server derives rRK (re-auth Root Key) → rIK (re-auth Integrity Key) → rMSK (re-auth MSK) in one RT. Used by FILS. | Key hierarchy:
EMSK (256b, from EAP server)
→ rRK = KDF(EMSK, 'EAP Re-auth Root Key@<domain>')
→ rIK = KDF(rRK, 'EAP Re-auth Integrity Key@<domain>')
→ rMSK = KDF(rRK, 'EAP Re-auth Master Session Key@<domain>' || seq_num)
rRK stays at ERP server. rIK stays at client. rMSK → PMK | ERP frames: EAP-Initiate/Re-auth (STA→server) + EAP-Finish/Re-auth (server→STA). ERP-capable: look for ERP Domain in EAP-Request/AKA or EAP-Initiate frames. |
| FILS Authentication | IEEE 802.11ai-2016
IEEE 802.11-2020 §26 | FILS (Fast Initial Link Setup) reduces connection time from ~500ms (full EAP) to <100ms by combining authentication, association, and key derivation into 2 frames. Two modes: FILS-SK (shared key, uses ERP-derived rMSK) and FILS-PK (public key, uses STA's asymmetric key). | FILS-SK key derivation:
PMK = rMSK (from ERP)
PTK = FILS-PRF(PMK, 'FILS PTK' || ANonce || SNonce || AP_MAC || STA_MAC)
KEK = PTK bits [0:255]
TK = PTK bits [256:383]
No 4-way handshake needed - keys derived from FILS frames.
FILS Auth frame carries: Wrapped Data IE (encrypted with KEK) containing GTK, IGTK, IP address config in Auth Response. | Auth frame alg=4 (FILS-SK) or alg=5 (FILS-PK). FILS: wlan.auth.alg==4 (FILS-SK SHA-256) or ==5 (FILS-SK SHA-384) or ==6 (FILS-PK). Timing: measure Auth Req → Assoc Resp. Target: <100ms total. |
| FILS Discovery Frame | IEEE 802.11ai-2016
§9.6.7.36 | FILS Discovery is broadcast as a Public Action frame (IEEE 802.11-2020 Table 9-364), sent by APs between beacons for fast passive discovery. In 6 GHz it is broadcast at ~20 ms (≤20 TU) intervals; it is much smaller than a beacon. | FILS Discovery frame body:
FILS Discovery Info field: SSID length(5b), Cap(1b), SNS(1b), RSN(1b)
FILS Discovery IE: Timestamp, Beacon Interval, Capability Info
Operating Class/Channel (if different from 2.4/5 GHz)
STA can extract SSID + channel + basic caps without waiting for full beacon. | wlan.fc.type_subtype==14 (Action No Ack)
FILS Discovery: category=21 (Public), action=34
Rate: 20ms interval in 6 GHz (per FCC 20-51 requirement for 6 GHz AP discovery) |
| FILS IP Address Assignment | IEEE 802.11ai-2016
§26.5 | FILS can deliver IP address configuration to the STA INSIDE the FILS Auth Response, eliminating the DHCP round trip. AP pre-fetches IP config from DHCP server and embeds it in the Wrapped Data IE (encrypted). | Wrapped Data IE contains:
IP Address KDE: assigned IP, subnet mask, router, DNS
DHCP Lease time, domain name
STA can start using IP immediately after Assoc - no DHCP exchange needed.
Requires DHCP proxy/relay integration at AP/WLC. | Look for FILS Wrapped Data IE in Auth Response. IP Address Assignment IE: OUI=00:0F:AC type=11. FILS IP assignment reduces total connect time by an additional 50-200ms. |
| Timing Comparison | IEEE 802.11-2020
802.11ai annex | Comparison of connection latency for different authentication methods. | Full EAP (WPA2-Enterprise): ~500ms
• Auth (Open) 2 frames: ~10ms
• Assoc 2 frames: ~20ms
• EAP exchange (PEAP): ~300ms
• 4-way handshake: ~50ms
• DHCP: ~150ms
With PMKSA cache (no ERP): ~150ms
• Skip EAP: saves ~300ms
• 4-way still needed
With OKC (roam to new AP): ~150ms
• Skip EAP: saves ~300ms
FILS (same BSS or neighbor with ERP): <100ms target
• Auth+Assoc+keys in 2 frames: ~30ms
• No 4-way needed
• No DHCP needed (if FILS IP) | Monitor roam latency: T(Reassoc Req) → T(first data frame after 4WHS)
Target thresholds:
< 50ms: 802.11r voice-grade
< 100ms: FILS enterprise target
< 200ms: acceptable for most apps |