How to get WPA3-192 bit working?

[PhilipDAth]

Has anyone had success getting WPA3-192-bit to work with WiFi-6E using EAP-TLS (EAP-TLS is the only supported option)?

I note that the RADIUS server has specific certificate and crypto requirements.  I have implemented those.

https://documentation.meraki.com/MR/Wi-Fi_Basics_and_Best_Practices/WPA3_Encryption_and_Configuratio...

It is unclear to me whether the supplicant has any specific certificate requirements.  My clients don't have certificates as strong, but I am not keen to roll that change out, and I am not clear that it is required.

I have checked that the client's WiFi chipset supports WPA3-192.  We are using the latest drivers.

The client has CW9164I.  I have tried multiple firmware versions.

I note that when it discusses WiFi7, it states that you must use SSIDs #13 - #15.  I have not tried that yet.  I will try that today.

When the client brings up the list of SSIDs in Windows 11, Windows shows a "cross" next to the SSID, and refuses to allow them to connect.

I feel close to giving up.  I'm hoping someone has managed to get this going and can give me a hint.

[PhilipDAth]

I found this interesting command to check if your clients can support WPA3-192:

netsh wlan show drivers

It should output something like:

[PhilipDAth · Accepted solution]

I have managed to get this to go.

I had one user manually configure the SSID in Windows to use WPA3-192.  It then worked.  I then had them "forget" the SSID, click on the SSID again, and it again "just worked".

There must have been some bad state in the SSID configuration in Windows from all the experimenting we had been doing.

We are going to pilot the config for a week, and then commence planning a full WPA3-192 roll-out.

Also of note is that we did not have to use SSID slots SSIDs #13 - #15.

[KarstenI]

Regarding the certificate requirements: Yes, all certs have to be at least EC-384 or RSA-3072. However, for my tests, only Android failed the connection when this requirement was not met. All the others didn't complain.

Some more Info on 192-bit mode: https://cyber-fi.net/index.php/2024/11/03/wpa3-192-bit-mode/

[PhilipDAth]

This is the combination that worked for me:

• RADIUS server certificate meeting the stated requirements
• Client certificates are nowhere near as strong.  Definately not meeting the requirements.

The RADIUS server is Microsoft NPS, and the clients are all Windows 11 using Intel WiFi NICs.

[KarstenI]

Yes, this combination also worked for me. But I would monitor every Windows update if they changed the behavior. I consider it a bug to allow the connection, but I assume that Apple and Microsoft disagree. IMO, only Android does it correctly.

[PhilipDAth]

That is a good, comprehensive article.  The author sounds familiar.  🙂

[RaphaelL]

Side note. 

@KarstenI I didn't know you had a blog. Nice articles are great presentation skills ! Good job

[KarstenI]

And for the SSID slots: All my WPA3-192bit SSIDs run on lower numbers. I read the document as indicating that this change is only for Wi-Fi 7.

[PhilipDAth]

Noted.  I tried it out of desperation, but it made no difference.

So I am leaning towards:

• Migrating from WiFi5 to WiFi-6E with WPA3-192 requires a new SSID.  There is no way to do an in-place migration.
• Migrating from anything to WiFi7 will require yet another new SSID, and it has to be configured in a slot with no other SSIDs.