gluon-mesh-wireless-sae.rst

gluon-mesh-wireless-sae

This package adds support for SAE on 802.11s mesh connections.

Enabling this package will require all 802.11s mesh connections to be encrypted using the SAE key agreement scheme. The security of SAE relies upon the authentication through a shared secret.

In the context of public mesh networks a shared secret is an obvious oxymoron. Still, this functionality may provide an improvement over unencrypted mesh connections in that it protects against a passive attacker who did not observe the key agreement. In addition Management Frame Protection (802.11w) gets automatically enabled on wireless mesh interfaces to prevent protocol-level deauthentication attacks.

If wifi.mesh.sae is enabled, a shared secret will automatically be derived from the prefix6 variable. This is as secure as it gets for a public mesh network.

For private mesh networks wifi.mesh.sae_passphrase should be set to your shared secret.

site.conf

These settings apply to all 802.11s mesh interfaces on all radios.

wifi.mesh.sae : optional

• true enables SAE on 802.11s mesh connections
• false disables SAE on 802.11s mesh connections
• defaults to false

wifi.mesh.sae_passphrase : optional

• sets a shared secret used to authenticate any two mesh nodes, crucial for private mesh networks
• should not be set, if the shared secret is shared with untrusted third parties, like in a publish mesh network
• defaults to an autogenerated value derived from prefix6

Example:

wifi = {
  mesh = {
    sae = true,
    -- sae_passphrase = "<shared secret>",
  },
},