text: "use strict";(self.webpackChunkspr_docs=self.webpackChunkspr_docs||[]).push([[2811],{3905:function(e,t,n){n.d(t,{Zo:function(){return c},kt:function(){return h}});var a=n(7294);function i(e,t,n){return t in e?Object.defineProperty(e,t,{value:n,enumerable:!0,configurable:!0,writable:!0}):e[t]=n,e}function r(e,t){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var a=Object.getOwnPropertySymbols(e);t&&(a=a.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),n.push.apply(n,a)}return n}function s(e){for(var t=1;t<arguments.length;t++){var n=null!=arguments[t]?arguments[t]:{};t%2?r(Object(n),!0).forEach((function(t){i(e,t,n[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(n)):r(Object(n)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(n,t))}))}return e}function o(e,t){if(null==e)return{};var n,a,i=function(e,t){if(null==e)return{};var n,a,i={},r=Object.keys(e);for(a=0;a<r.length;a++)n=r[a],t.indexOf(n)>=0||(i[n]=e[n]);return i}(e,t);if(Object.getOwnPropertySymbols){var r=Object.getOwnPropertySymbols(e);for(a=0;a<r.length;a++)n=r[a],t.indexOf(n)>=0||Object.prototype.propertyIsEnumerable.call(e,n)&&(i[n]=e[n])}return i}var d=a.createContext({}),l=function(e){var t=a.useContext(d),n=t;return e&&(n="function"==typeof e?e(t):s(s({},t),e)),n},c=function(e){var t=l(e.components);return a.createElement(d.Provider,{value:t},e.children)},p={inlineCode:"code",wrapper:function(e){var t=e.children;return a.createElement(a.Fragment,{},t)}},u=a.forwardRef((function(e,t){var n=e.components,i=e.mdxType,r=e.originalType,d=e.parentName,c=o(e,["components","mdxType","originalType","parentName"]),u=l(n),h=i,f=u["".concat(d,".").concat(h)]||u[h]||p[h]||r;return n?a.createElement(f,s(s({ref:t},c),{},{components:n})):a.createElement(f,s({ref:t},c))}));function h(e,t){var n=arguments,i=t&&t.mdxType;if("string"==typeof e||i){var r=n.length,s=new Array(r);s[0]=u;var o={};for(var d in t)hasOwnProperty.call(t,d)&&(o[d]=t[d]);o.originalType=e,o.mdxType="string"==typeof e?e:i,s[1]=o;for(var l=2;l<r;l++)s[l]=n[l];return a.createElement.apply(null,s)}return a.createElement.apply(null,n)}u.displayName="MDXCreateElement"},2823:function(e,t,n){n.r(t),n.d(t,{assets:function(){return c},contentTitle:function(){return d},default:function(){return h},frontMatter:function(){return o},metadata:function(){return l},toc:function(){return p}});var a=n(7462),i=n(3366),r=(n(7294),n(3905)),s=["components"],o={slug:"multipsk and wpa3",title:"SPR Supports WPA3 with Multiple Passwords",authors:"ltsrad",tags:["SPR","wifi6","WPA3","PPSK"]},d=void 0,l={permalink:"/pages/blog/multipsk and wpa3",source:"@site/blog/2022-05-02-wpa3-multipsk.md",title:"SPR Supports WPA3 with Multiple Passwords",description:"SPR's WPA3 Multiple Passwords per SSID Surprises People",date:"2022-05-02T00:00:00.000Z",formattedDate:"May 2, 2022",tags:[{label:"SPR",permalink:"/pages/blog/tags/spr"},{label:"wifi6",permalink:"/pages/blog/tags/wifi-6"},{label:"WPA3",permalink:"/pages/blog/tags/wpa-3"},{label:"PPSK",permalink:"/pages/blog/tags/ppsk"}],readingTime:2.16,truncated:!1,authors:[{name:"Alex Radocea",title:"Founder",url:"https://twitter.com/defendtheworld",key:"ltsrad"}],frontMatter:{slug:"multipsk and wpa3",title:"SPR Supports WPA3 with Multiple Passwords",authors:"ltsrad",tags:["SPR","wifi6","WPA3","PPSK"]},nextItem:{title:"Gigabit WiFi with SPR & The 4x4 MT7915",permalink:"/pages/blog/wifi6"}},c={authorsImageUrls:[void 0]},p=[{value:"SPR&#39;s WPA3 Multiple Passwords per SSID Surprises People",id:"sprs-wpa3-multiple-passwords-per-ssid-surprises-people",level:3},{value:"WPA3 Authentication is Fundamentally Different",id:"wpa3-authentication-is-fundamentally-different",level:3},{value:"SPR Solves this with MAC Filtering",id:"spr-solves-this-with-mac-filtering",level:3},{value:"Adding Device is Seamless",id:"adding-device-is-seamless",level:3},{value:"Adding Devices Workflow",id:"adding-devices-workflow",level:3},{value:"First, go to the add device modal and add a device name and hit next",id:"first-go-to-the-add-device-modal-and-add-a-device-name-and-hit-next",level:4},{value:"Next, scan the QR code  or type the passphrase on a new device",id:"next-scan-the-qr-code--or-type-the-passphrase-on-a-new-device",level:4},{value:"Upon connection the UI will notify success",id:"upon-connection-the-ui-will-notify-success",level:4},{value:"Per-device Passphrases Enable Secure Device Identity",id:"per-device-passphrases-enable-secure-device-identity",level:3}],u={toc:p};function h(e){var t=e.components,o=(0,i.Z)(e,s);return(0,r.kt)("wrapper",(0,a.Z)({},u,o,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("h3",{id:"sprs-wpa3-multiple-passwords-per-ssid-surprises-people"},"SPR's WPA3 Multiple Passwords per SSID Surprises People"),(0,r.kt)("p",null,"From WiFi nerds and people working on WiFi products \u2014 I've seen surprise a few times now that SPR supports Multi-PSK for WPA3, which is already built into HostAP. I'm told that most other projects simply don't do it, putting SPR at the head of the pack! In this post I'll share how it's integrated, so that others can benefit from the ideas and improve WiFi security for people all around the world."),(0,r.kt)("h3",{id:"wpa3-authentication-is-fundamentally-different"},"WPA3 Authentication is Fundamentally Different"),(0,r.kt)("p",null,"WPA3 authentication uses ",(0,r.kt)("a",{parentName:"p",href:"https://datatracker.ietf.org/doc/html/rfc7664"},"Dragonfly"),", a Zero-Knowledge Proof in its Simulataneous Authentication of Equals Handshake protocol. With SAE there is nothing to sniff and crack offline from the key exchange. This is in contrast to WPA/WPA2 which is notorious for password cracking of weak passwords from captured handshakes -- or even more conteniently, by using the ",(0,r.kt)("a",{parentName:"p",href:"https://hashcat.net/forum/thread-7717.html"},"RSN IE specification flaw"),"."),(0,r.kt)("p",null,"For Multi-PSK, a router can go down the list of stored PSKs and try each key and see if it had a matching one.\nFor WPA3, this is not possible. Authenticating a password requires an interactive zero knowledge proof, so a new handshake is required."),(0,r.kt)("h3",{id:"spr-solves-this-with-mac-filtering"},"SPR Solves this with MAC Filtering"),(0,r.kt)("p",null,"PSKs are assigned by MAC address. HostAP finds the passphrase to use by MAC address to perform the authentication, using the correct PSK the first time around for the interactive proof."),(0,r.kt)("p",null,"The syntax for hostapd.conf to assign multiple devices is as follows:"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"sae_password=1stPassphraseHere|mac=01:23:45:67:89:aa\nsae_password=2ndPassphraseHere|mac=01:23:45:67:89:ab\n")),(0,r.kt)("h3",{id:"adding-device-is-seamless"},"Adding Device is Seamless"),(0,r.kt)("p",null,"Adding devices is an easy process. If a user does know a MAC address, they can certainly\nadd the MAC address ahead of time. However, SPR can use a wildcard MAC to match a new\nincoming device. When the device authenticates, that PSK will be assigned to the device."),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre"},"sae_password=3rdPassphraseHere|mac=ff:ff:ff:ff:ff:ff\n")),(0,r.kt)("h3",{id:"adding-devices-workflow"},"Adding Devices Workflow"),(0,r.kt)("h4",{id:"first-go-to-the-add-device-modal-and-add-a-device-name-and-hit-next"},"First, go to the add device modal and add a device name and hit next"),(0,r.kt)("p",null,(0,r.kt)("img",{loading:"lazy",src:n(6795).Z,width:"980",height:"642"})),(0,r.kt)("h4",{id:"next-scan-the-qr-code--or-type-the-passphrase-on-a-new-device"},"Next, scan the QR code  or type the passphrase on a new device"),(0,r.kt)("p",null,(0,r.kt)("img",{loading:"lazy",src:n(184).Z,width:"968",height:"809"})),(0,r.kt)("h4",{id:"upon-connection-the-ui-will-notify-success"},"Upon connection the UI will notify success"),(0,r.kt)("p",null,(0,r.kt)("img",{loading:"lazy",src:n(1224).Z,width:"974",height:"846"})),(0,r.kt)("h3",{id:"per-device-passphrases-enable-secure-device-identity"},"Per-device Passphrases Enable Secure Device Identity"),(0,r.kt)("p",null,"SPR uses the unique PSK and MAC Pair to create an unspoofable network identity\nfor a device. If a device is compromised or resold, a user doesn't have to reset\nall of their passwords."),(0,r.kt)("p",null,"Each device is placed into an isolated VLAN, and then networking rules define how the device\nconnects back into the network. With a traditional guest-network setup or shared passphrase setup,\nthis kinds of fine grained firewall rules would be rendered ineffective by MAC Cloaking/Spoofing"))}h.isMDXComponent=!0},6795:function(e,t,n){t.Z=n.p+"assets/images/add_device_1-01b0f5f44775c92f40090e85db695506.png"},184:function(e,t,n){t.Z=n.p+"assets/images/add_device_2-ec89e7ff6f26c0d21d79dc9d059c18d9.png"},1224:function(e,t,n){t.Z=n.p+"assets/images/add_device_3-48bef3bc65a140fc598aa1497ed71e56.png"}}]);