802.11 Fast BSS Transition (FT) Part 1 of 2

802.11 Fast BSS Transition (FT) Part 1 of 2

By CWNP On 08/21/2007 - 36 Comments

The 802.11i amendment gave us Preauthentication and Pairwise Master Key (PMK) Caching.  Nothing fancy, just the basics.  Preauthentication enables supplicants (stations) to authenticate with authenticators (APs or WLAN controllers) to which they may roam.  Preauthentication always happens through the AP to which the station is currently associated – over the distribution system (typically an Ethernet network).


PMK Caching allows supplicants and authenticators to cache PMK Security Associations (PMKSAs) so that a supplicant revisiting an authenticator to which it has previously authenticated can skip the 802.1X/EAP process and proceed directly to the 4-Way Handshake.  The 4-Way Handshake is used by an 802.1X supplicant and an authenticator to derive Pairwise Transient Keys (PTKs) which are used for encrypting data frames.  PMK Caching is often called, “fast roam-back” since supplicants must have previously authenticated (and formed a PMKSA) with the authenticator in order to proceed directly to the 4-Way Handshake.

Due to the need to roam “forward” to authenticators to which the supplicant has never authenticated, another protocol was developed: Opportunistic PMK Caching (OPC).  OPC must be supported on both the supplicant and authenticator, and fortunately OPC has been adopted as the current de-facto industry standard for fast roaming.  Supplicants supporting OPC include Microsoft’s WZC and Juniper’s Odyssey Access Client.  Authenticators supporting OPC include Motorola/Symbol, Colubris, Aruba, and more.  OPC allows the PMK in the initial PMKSA formed by the supplicant and authenticator to be reused across the network.  The PMK is redistributed (either to other physical APs or within the WLAN controller software) by the WLAN system and given new PMKIDs unique to each AP.  A component in the forming of each unique PMKID is the new AP’s MAC address (BSSID).  By using the same OPC algorithm, the supplicants and authenticators form the same unique PMKID for each authenticator.  The supplicant places the unique PMKID into its reassociation request frame, and when the authenticator validates the PMKID, the AP starts the 4-Way Handshake instead of the 802.1X/EAP authentication exchange process.

The forthcoming IEEE 802.11r amendment will rewrite most of the authentication and key management structure of the IEEE 802.11i amendment to allow for a 3-tier key architecture instead of the current 2-tier model.  For more information on 802.11i Authentication and Key Management (AKM), refer to the CWNP whitepaper by the same name found here: http://www.cwnp.com/learning_center/search_details.php?doc_id=duge

Blog Disclaimer: The opinions expressed within these blog posts are solely the author’s and do not reflect the opinions and beliefs of the Certitrek, CWNP or its affiliates.

0 Responses to 802.11 Fast BSS Transition (FT) Part 1 of 2

Subscribe by Email
There are no comments yet.
<< prev - comments page 1 of 1 - next >>

Leave a Reply

Please login or sign-up to add your comment.
Success Stories

I literally just came out of the testing centre having taken the CWDP exam. The certification process opened my mind to different techniques and solutions. This knowledge can only broaden your perspective. Great job, CWNP, you have a great thing going on here.

Read More

Working through the CWNP coursework and certifications helped not only to deepen my technical knowledge and understanding, but also it boosted my confidence. The hard work it took to earn my CWNE has been rewarding in so many ways.

Read More

I want to commend you and all at CWNP for having a great organization. You really 'raise the bar' on knowing Wi-Fi well. I have learned a ton of information that is helping my job experience and personal career goals, because of my CWAP/CWDP/CWSP studies. Kudos to all at CWNP.

Read More