WPA3 support coming to OpenBSD

OpenBSD is moving closer to adding WPA3 support.

Stefan Sperling (stsp@) posted a message with the subject add WPA3 support to the tech mailling list with a patch that implements WPA3 in OpenBSD's net80211 subsystem including ifconfig(8), asking for testing and feedback.

He also noted that this effort is supported by the NLNet Foundaton (as noted in an earlier article).

The message reads,

List:       openbsd-tech
Subject:    add WPA3 support
From:       Stefan Sperling <stsp () stsp ! name>
Date:       2026-07-18 11:40:08
Message-ID: altmGGN9mVtJ1Eqd () yumyan ! stsp ! name

The patch below adds support for WPA3 to the net80211 subsystem.

This effort is supported by the NLnet Foundation's NGI0 Commons Fund.
Without such support, I would not have been able to invest the time
required to work on this. I am very grateful to be given this opportunity.

More review will be needed to ensure that this implementation of WPA3
is free of bugs. Please keep this in mind while running this patch.
NLnet will arrange an independent security audit once we consider our
part of this work complete.

All drivers which support PMF can use WPA3, which are: iwm, iwx, and qwx
So far, I have tested this patch on iwx AX200 only. I will roll out
this patch to more of my devices now. Help with testing is welcome.

There are both userland and kernel changes involved.

First, rebuild ifconfig:

  cd /usr/src/
  make obj
  doas make includes
  cd sbin/ifconfig
  make
  doas make install

Now rebuild the kernel and install it as usual, and reboot.

Configuring WPA3 network with ifconfig works just like WPA2 does.
The SAE handshake is suitable for password authentication only.
"WPA3 Enterprise" setups are out of scope.

Snapshot test builds on all supported platforms would be welcome.
This patch adds WPA3 support to all net80211-enabled kernels, so they
will all grow a bit. I don't expect huge growth since the code is kept
as small as possible. It's a cost we will have to carry unless we want
this to be under infdef SMALL. But I would prefer to be always present.

However, the patch only adds WPA3 support to ifconfig in an installed
system. The ramdisk/bsd.rd version of ifconfig will not support WPA3 yet.
The ifconfig binary grows a lot (ifconfig now links to libcrypto) and could
cause trouble for building snapshots. I am postponing this part for now,
and would prefer to work this problem out in-tree.

WPA3 has a complicated history. There are two versions of WPA3.
The initially standardized version suffered from side-channel leaks
found by Mathy Vanhoef and dubbed "Dragonblood". For details, see
https://wpa3.mathyvanhoef.com/   A revised and fixed version has been
standardized and is mandatory in the 6 GHz band as of Wifi 6e (11ax) and
mandatory on all bands as of Wifi 7 (11be).

The password-derivation strategy used in the initial version of WPA3 is
known as "hunting-and-pecking". The revised version uses a "hash to element"
strategy instead. For details about the differences, see:
https://wizardfi.com/security/2024/03/29/hash-to-curve.html

I am only adding support for the revised version. Access points which
use the initial version of WPA3 will remain incompatible with OpenBSD.

Apart from being side-channel-free, the revised version has the advantage
that some computations required for the SAE handshake can be done ahead
of time, provided the network name and password are known. Which is the
case in our version of ifconfig, just like it was with WPA2.

The initial WPA3 version required knowledge of the peer's MAC address before
anything could be computed. This pushes all the work to the point in time
when a connection attempt is made. For us, this is inside the kernel.

Since we handle the WPA handshake in the kernel, being able to pre-compute
values in ifconfig is a huge simplification for us. It avoids adding a lot
more crypto code to the kernel, and keeps the kernel code's complexity low.

The kernel-side crypto used in this implementation is based on stripped
down code lifted from BearSSL. Several alternatives were evaluated with
help from Theo Buehler (tb@) and we ended up settling on this approach.

ifconfig uses code that calls into libcrypto, and most of this was modeled
on code found in the well-known w1.fi hostapd/wpa_supplicant implementation.

I don't expect that requiring "hash-to-element" will be a huge problem
because we are now late enough in the history of WPA3. Supporting the
initial version would have downsides for us. The "hunting-and-pecking"
approach is known to be vulnerable. The workarounds for this problem are
costly and we would have to carry these workarounds in the kernel as an
entirely separate implementation of the SAE handshake. Adding such
complexity only to support known-broken devices is not worth it to me.
Broken access points should either be patched (reasaonable vendors should
be providing software upgrades) or be run in WPA3/WPA2 mixed mode, such
that we can connect with WPA2.

Diff follows:

-- followed by the diff that implements the changes to the kernel and ifconfig(8).

If you are able to test the code and report, please do.

Note that this is an early version of the code, but it is a clear sign that WPA3 support is coming to our favorite operating system.