BRCM/Cypress 43455 firmware doesn't support WPA3-SAE

[herrernst]

At raspberrypi/linux#4718, there's a discussion why internal WiFi doesn't support WPA3-SAE encryption (which is the most secure).
Turns out RPi OS ships with firmware 7.45.241 (1a2f2fa CY) CRC: 959ad1c7 Date: Mon 2021-11-01 00:40:29 PDT Ucode Ver: 1043.2164 FWID 01-703fd60 that doesn't support SAE:

$ curl -sL https://github.com/RPi-Distro/firmware-nonfree/raw/bookworm/debian/config/brcm80211/cypress/cyfmac43455-sdio-standard.bin | grep -i sae -c
0

But on "official" linux-firmware repo AND in Debian repos there's a slightly older 7.45.234 (4ca95bb CY) CRC: 212e223d Date: Thu 2021-04-15 03:06:00 PDT Ucode Ver: 1043.2161 FWID 01-996384e2 that announces "sae" support:

 $ curl -sL https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/plain/cypress/cyfmac43455-sdio.bin | strings | tail -n 2 | grep -i sae
43455c0-roml/43455_sdio-pno-aoe-pktfilter-pktctx-wfds-mfp-dfsradar-wowlpf-idsup-idauth-noclminc-clm_min-obss-obssdump-swdiv-gtkoe-roamprof-txbf-ve-sae-dpp-sr-okc-bpd Version: 7.45.234 (4ca95bb CY) CRC: 212e223d Date: Thu 2021-04-15 03:06:00 PDT Ucode Ver: 1043.2161 FWID 01-996384e2

Then iw also shows SAE support on RPi OS 12:

$ iw phy | grep -i sae
		* [ SAE_OFFLOAD ]: SAE offload support
		* [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support

Why does RPi's version not support SAE?

[sk8board]

@herrernst @XECDesign

To resolve this problem, would it be as easy as submitting a Pull Request with the older WiFi driver that supports WPA3-SAE?

[sk8board]

There was a pull request from two years ago for Update CYW43455 to 7.45.234, but they went with 7.45.231.

FYI: Here is the location of the CYW43455 firmware in this repository.
debian/config/brcm80211/cypress

[XECDesign]

I don't think a PR would help. What we ship is decided between infineon and @pelwell.

[pelwell]

We are likely to switch to the standard Infineon releases in the relatively near future, but @XECDesign is correct in that a PR won't make a difference either way.

[sk8board]

@pelwell There are many people who would like Raspberry Pi OS to support WPA3-SAE, including

https://holtmann.dev/enabling-wpa3-on-raspberry-pi/

https://www.youtube.com/watch?v=yUxpm8ucQB8

Do you know if the new release will support WPA3-SAE?

[pelwell]

Do you know if the new release will support WPA3-SAE?

That's the intention, but weirdly the latest Cypress release of the 43455 firmware (which I found here -https://community.infineon.com/t5/Wi-Fi-Bluetooth-for-Linux/Cypress-Linux-WiFi-Driver-Release-FMAC-2023-09-01/td-p/492862) doesn't seem to enable it.

The firmware string for the 2023-09-01 7.45.265 release is:

43455c0-roml/43455_sdio-pno-aoe-pktfilter-pktctx-wfds-mfp-dfsradar-wowlpf-noclminc-clm_min-obss-obssdump-swdiv-gtkoe-roamprof-txbf-ve-extsae-dpp-sr-okc-bpd Version: 7.45.265 (28bca26 CY) CRC: 68bafb8c Date: Tue 2023-08-29 01:51:02 PDT Ucode Ver: 1043.2170 FWID 01-b677b91b

whereas for the 7.4.234 release it is:

43455c0-roml/43455_sdio-pno-aoe-pktfilter-pktctx-wfds-mfp-dfsradar-wowlpf-idsup-idauth-noclminc-clm_min-obss-obssdump-swdiv-gtkoe-roamprof-txbf-ve-sae-dpp-sr-okc-bpd Version: 7.45.234 (4ca95bb CY) CRC: 212e223d Date: Thu 2021-04-15 03:06:00 PDT Ucode Ver: 1043.2161 FWID 01-996384e2

The former gives nothing:

$ iw list | grep SAE

And this is even though the firmware string includes extsae ,whereas with the upstream, older firmware you get:

$ iw list | grep SAE
                * [ SAE_OFFLOAD ]: SAE offload support
                * [ SAE_OFFLOAD_AP ]: AP mode SAE authentication offload support

So it looks like the upstream firmware is more suitable.

But it seems like changing the firmware is only half the problem, if getting WPA3 support also requires switching to iwd.

[sk8board]

@pelwell
If you do much research about using WPA3-SAE with Raspberry Pi OS, there are plenty of people who are willing to use IWD.

If switching to IWD is not acceptable, then why not upgrade wpa_supplicant to a newer version (2.10) which supports WPA3-SAE?

https://w1.fi/wpa_supplicant/

[pelwell]

If you do much research about using WPA3-SAE with Raspberry Pi OS, there are plenty of people who are willing to use IWD.

I didn't say it was unacceptable, but it's definitely a barrier to entry.

If switching to IWD is not acceptable, then why not upgrade wpa_supplicant to a newer version (2.10) which supports WPA3-SAE?

My Pi 5 seems to already be running 2.10:

pi@raspberrypi:~$ wpa_supplicant -v
wpa_supplicant v2.10
Copyright (c) 2003-2022, Jouni Malinen <j@w1.fi> and contributors

But I don't think it's being used, since I'm connected to an AP but wpa_supplicant.conf has no mention of it.

[XECDesign]

But I don't think it's being used, since I'm connected to an AP but wpa_supplicant.conf has no mention of it.

If you're using NetworkManager, it talks to wpa_supplicant through a socket rather than trying to populate the conf file.

[sk8board]

Then it seems the only barrier to WPA3 is upgrading the firmware. Is my understanding correct?

[pelwell]

I have upgraded the firmware locally, but apart from the iw list output I'm seeing no signs of WPA3 ability.

[sk8board]

@holtmann
The RPi-Distro team is looking to add WPA3-SAE function to Raspberry Pi OS.

Since you have been down this path with WPA3-SAE on Raspberry Pi OS. Could you help @pelwell understand why he is not able to get this function to work as you described on your website?
https://holtmann.dev/enabling-wpa3-on-raspberry-pi/

[t0b3]

possibly related to https://github.com/Infineon/wpa3-external-supplicant

[pelwell]

Well, having tested the proposed firmware with an AP configured to only support WPA3, it does indeed appear to connect. Further work may be required to support AP mode, but in the usual Pi-as-client mode it's looking good.

See #42.

[sk8board]

@pelwell Thank you for your help in working toward WPA3 function in Raspberry Pi OS!

[pelwell]

FYI, testing the new firmware on a clean RPiOS image has shown that you only gain the WPA3 support when NetManager is configured to use iwd instead of wpa_supplicant. That's not to say that wpa_supplicant cannot ever support WPA3, but the version we are shipping certainly doesn't.

The steps to enable WPA3 are:

1. Install the new firmware (sudo apt install firmware-brcm80211 when we push the update).
2. Install iwd (sudo apt install iwd).
3. Put the following in /etc/NetworkManager/conf.d/wifi_backend.conf:

   [device]
   wifi.backend=iwd
   

4. Reboot.

Obviously the aim is to have this work automatically in a new image, but we're not there yet.