WPA3 and Wi-Fi Enhanced Open

Android 10 introduces support for the Wi-Fi Alliance's (WFA) Wi-Fi Protected Access version 3 (WPA3) and Wi-Fi Enhanced Open standards. For more information, see Security on the WFA site.

WPA3 is a new Wi-Fi Alliance (WFA) security standard for personal and enterprise networks. It aims to improve overall Wi-Fi security by using modern security algorithms and stronger cipher suites. WPA3 has two parts:

  • WPA3-Personal: Uses simultaneous authentication of equals (SAE) instead of pre-shared key (PSK), providing users with stronger security protections against attacks such as offline dictionary attacks, key recovery, and message forging.
  • WPA3-Enterprise: Offers stronger authentication and link-layer encryption methods, and an optional 192-bit security mode for sensitive security environments.

Wi-Fi Enhanced Open is a new Wi-Fi Alliance (WFA) security standard for public networks based on opportunistic wireless encryption (OWE). It provides encryption and privacy on open, non-password-protected networks in areas such as cafes, hotels, restaurants, and libraries. Enhanced Open doesn't provide authentication.

WPA3 and Wi-Fi Enhanced Open improve overall Wi-Fi security, providing better privacy and robustness against known attacks. As many devices don't yet support these standards or haven't yet had software upgrades to support these features, WFA has proposed the following transition modes:

  • WPA2/WPA3 transition mode: The serving access point supports both standards concurrently. In this mode, Android 10 devices use WPA3 to connect, and devices running Android 9 or lower use WPA2 to connect to the same access point.
  • OWE transition mode: The serving access point supports both OWE and open standards concurrently. In this mode, Android 10 devices use OWE to connect, and devices running Android 9 or lower connect to the same access point without any encryption.

WPA3 and Wi-Fi Enhanced Open are only supported in client mode.

Implementation

To support WPA3 and Wi-Fi Enhanced Open, implement the supplicant HAL interface design language (HIDL) provided in the Android Open Source Project (AOSP) at hardware/interfaces/wifi/supplicant/1.2/.

The following are required to support WPA3 and OWE:

  • Linux kernel patches to support SAE and OWE

    • cfg80211
    • nl80211
  • wpa_supplicant with support for SAE, SUITEB192 and OWE

  • Wi-Fi driver with support for SAE, SUITEB192, and OWE

  • Wi-Fi firmware with support for SAE, SUITEB192, and OWE

  • Wi-Fi chip with support for WPA3 and OWE

Public APIs are available in Android 10 to allow apps to determine device support for these features:

WifiConfiguration.java contains new key management types, as well as pairwise ciphers, group ciphers, group management ciphers, and Suite B ciphers, which are required for OWE, WPA3-Personal, and WPA3-Enterprise.

Enabling WPA3 and Wi-Fi Enhanced Open

To enable WPA3-Personal, WPA3-Enterprise, and Wi-Fi Enhanced Open in the Android framework:

  • WPA3-Personal: Include the CONFIG_SAE compilation option in the wpa_supplicant configuration file.

    # WPA3-Personal (SAE)
    CONFIG_SAE=y
    
  • WPA3-Enterprise: Include the CONFIG_SUITEB192 and CONFIG_SUITEB compilation options in the wpa_supplicant configuration file.

    # WPA3-Enterprise (SuiteB-192)
    CONFIG_SUITEB=y
    CONFIG_SUITEB192=y
    
  • Wi-Fi Enhanced Open: Include the CONFIG_OWE compilation option in the wpa_supplicant configuration file.

    # Opportunistic Wireless Encryption (OWE)
    # Experimental implementation of draft-harkins-owe-07.txt
    CONFIG_OWE=y
    

If WPA3-Personal, WPA3-Enterprise, or Wi-Fi Enhanced Open aren't enabled, users won't be able to manually add, scan, or connect to these types of networks.

Validation

To test your implementation, run the following tests.

Unit tests

Run SupplicantStaIfaceHalTest to verify the behavior of the capability flags for WPA3 and OWE.

atest SupplicantStaIfaceHalTest

Run WifiManagerTest to verify the behavior of the public APIs for this feature.

atest WifiManagerTest

Integration test (ACTS)

To run an integration test, use the Android Comms Test Suite (ACTS) file, WifiWpa3OweTest.py, located in tools/test/connectivity/acts/tests/google/wifi.

VTS tests

Run VtsHalWifiSupplicantV1_2Host to test the behavior of the supplicant HAL v1.2.

vts-tradefed run commandAndExit vts --skip-all-system-status-check --primary-abi-only --skip-preconditions --module VtsHalWifiSupplicantV1_2Host