From: Kevin Lo <kevlo@kevlo.org>
Subject: Re: add WPA3 support
To: tech@openbsd.org
Date: Fri, 24 Jul 2026 14:57:38 +0800

On Sat, Jul 18, 2026 at 01:40:08PM +0200, Stefan Sperling wrote:
> 
> The patch below adds support for WPA3 to the net80211 subsystem.
> 
> This effort is supported by the NLnet Foundation's NGI0 Commons Fund.
> Without such support, I would not have been able to invest the time
> required to work on this. I am very grateful to be given this opportunity.
> 
> More review will be needed to ensure that this implementation of WPA3
> is free of bugs. Please keep this in mind while running this patch.
> NLnet will arrange an independent security audit once we consider our
> part of this work complete.
> 
> All drivers which support PMF can use WPA3, which are: iwm, iwx, and qwx
> So far, I have tested this patch on iwx AX200 only. I will roll out
> this patch to more of my devices now. Help with testing is welcome.

First of all, thanks for your work on adding WPA3 support!
I tested iwx and qwx with the AP configured in WPA3-Personal only mode and 
in mixed mode, both worked perfectly, no problems so far.

qwx0 at pci2 dev 0 function 0 "Qualcomm QCNFA765" rev 0x01: msi
qwx0: restrict all mbufs to low memory
qwx0: wcn6855 hw2.1 fw 0x11088c35 address xx:xx:xx:xx:xx:xx

qwx0: flags=a48843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF6TEMP,AUTOCONF6,AUTOCONF4> mtu 1500
        lladdr xx:xx:xx:xx:xx:xx
        index 1 priority 4 llprio 3
        groups: wlan egress
        media: IEEE802.11 autoselect (HT-MCS4 mode 11n)
        status: active
        ieee80211: join puffy chan 161 bssid xx:xx:xx:xx:xx:xx -40dBm wpakey wpaprotos wpa2,wpa3 wpaakms psk,sha256-psk,sae wpaciphers ccmp wpagroupcipher ccmp
        inet6 fe80::3ad5:7aff:fe27:eac3%qwx0 prefixlen 64 scopeid 0x1
        inet 10.0.1.7 netmask 0xff000000 broadcast 10.255.255.255

iwx0 at pci0 dev 20 function 3 "Intel Wi-Fi 6 AX211" rev 0x01, msix
iwx0: restrict all mbufs to low memory
iwx0: hw rev 0x370, fw 77.f92b5fed.0, pnvm 285b3568, address xx:xx:xx:xx:xx:xx

iwx0: flags=a48843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,AUTOCONF6TEMP,AUTOCONF6,AUTOCONF4> mtu 1500
	lladdr xx:xx:xx:xx:xx:xx
	index 1 priority 4 llprio 3
	groups: wlan egress
	media: IEEE802.11 autoselect (VHT-MCS3 mode 11ac)
	status: active
	ieee80211: join puffy chan 161 bssid xx:xx:xx:xx:xx:xx 89% wpakey wpaprotos wpa2,wpa3 wpaakms psk,sha256-psk,sae wpaciphers ccmp wpagroupcipher ccmp powersave on (100ms sleep)
	inet6 fe80::9209:dfff:fe8b:8eb3%iwx0 prefixlen 64 scopeid 0x1
	inet 10.0.1.8 netmask 0xff000000 broadcast 10.255.255.255

As landry@ already noted, once associated there is no way to tell from 
ifconfig which mode the station is actually running in.
It would be useful if ifconfig could show this, thanks.