Skip to main content

SPR Supports WPA3 with Multiple Passwords

· 2 min read
Alex Radocea

SPR's WPA3 Multiple Passwords per SSID Surprises People​

WiFi nerds and people working on WiFi products have shared their surprise with me a few times now about the integration for multi-PSK with WPA3. This is something already mostly built into HostAP so it should be possible anywhere, although it is not obvious from the documentation. I'm told that most other projects simply don't do it, putting SPR at the head of the pack! In this post I'll share how it's integrated, so that others can benefit from the ideas and improve WiFi security for people all around the world.

WPA3 Authentication is Fundamentally Different​

WPA3 authentication uses Dragonfly, a Zero-Knowledge Proof in its Simulataneous Authentication of Equals Handshake protocol. With SAE there is nothing to sniff and crack offline from the key exchange. This is in contrast to WPA/WPA2 which is notorious for password cracking of weak passwords from captured handshakes -- or even more conteniently, by using the RSN IE specification flaw.

For Multi-PSK, a router can go down the list of stored PSKs and try each key and see if it had a matching one. For WPA3, this is not possible. Authenticating a password requires an interactive zero knowledge proof, so a new handshake is required to try a different password.

SPR Uses HostAP's MAC Assignment​

PSKs are assigned by MAC address. HostAP finds the passphrase to use by MAC address to perform the authentication, using the correct PSK the first time around for the interactive proof.

The syntax for hostapd.conf to assign multiple devices is as follows:

sae_password=1stPassphraseHere|mac=01:23:45:67:89:aa
sae_password=2ndPassphraseHere|mac=01:23:45:67:89:ab

Adding Device is Seamless​

Adding devices is an easy process. If a user does know a MAC address, they can certainly specify the MAC address ahead of time. However, SPR can use a wildcard MAC to match a new incoming device. When the device authenticates, that PSK will be assigned to the device.

sae_password=3rdPassphraseHere|mac=ff:ff:ff:ff:ff:ff

Devices Workflow​

First, go to the add device modal and add a device name and hit next​

Next, scan the QR code or type the passphrase on a new device​

Upon connection the UI will notify success and the PSK will be assigned to the MAC​