Figure <ANA-0>—FILS Authentication Create section 4.10.3.4b 4.10.3.4b AKM operations using FILS authentication without an online trusted third party It is assumed that both STAs using FILS have obtained a public key certificate from a Certificate Authority and that each STA is capable of verifying this certificate during execution of the FILS authentication scheme. The manner by which these certificates are obtained is outside the scope of this standard. The following operations are carried out when FILS authentication is used with a trusted third party: The STA discovers the AP’s policy through passive monitoring of Beacon frames or through active probing. If a FILS-capable STA discovers that the AP supports FILS authentication and the identity of the trusted third party is known (and trusted) by the STA, the STA and AP proceed to FILS authentication The STA initiates FILS authentication by sending a Authentication frame to the AP, after which the AP responds with a Authentication frame. The STA and AP generate a PMK as a result of this exchange. The STA sends an Association Request frame to the AP and receives a Association Response frame from the AP. This exchange provides proof-of-possession of the PMK and enables the creation of a PTKSA and further establishment of FILS state. Modify section 6.3.5.2 as indicated: (11s) 6.3.5.2 MLME-AUTHENTICATE.request 6.3.5.2.1 Function This primitive requests authentication with a specified peer MAC entity. 6.3.5.2.2 Semantics of the service primitive The primitive parameters are as follows: MLME-AUTHENTICATE.request( PeerSTAAddress, AuthenticationType, AuthenticateFailureTimeout, Content of FT Authentication elements, Content of SAE Authentication Frame, FILS wrapped data, VendorSpecificInfo ) Name Type range Description PeerSTAAddress MACAddress Any individual MAC Specifies the address of the peer address MAC entity with which to perform the authentication process. AuthenticationType Enumeration OPEN_SYSTEM, Specifies the type of authentication SHARED_KEY, algorithm to use during the FAST_BSS_TRANSITION, authentication process. SAE, FILS
Figure <ANA-0>—FILS Authentication Create section 4.10.3.4b 4.10.3.4b AKM operations using FILS authentication without an online trusted third party It is assumed that both STAs using FILS have obtained a public key certificate from a Certificate Authority and that each STA is capable of verifying this certificate during execution of the FILS authentication scheme. The manner by which these certificates are obtained is outside the scope of this standard. The following operations are carried out when FILS authentication is used with a trusted third party: The STA discovers the AP’s policy through passive monitoring of Beacon frames or through active probing. If a FILS-capable STA discovers that the AP supports FILS authentication and the identity of the trusted third party is known (and trusted) by the STA, the STA and AP proceed to FILS authentication The STA initiates FILS authentication by sending a Authentication frame to the AP, after which the AP responds with a Authentication frame. The STA and AP generate a PMK as a result of this exchange. The STA sends an Association Request frame to the AP and receives a Association Response frame from the AP. This exchange provides proof-of-possession of the PMK and enables the creation of a PTKSA and further establishment of FILS state. Modify section 6.3.5.2 as indicated: (11s) 6.3.5.2 MLME-AUTHENTICATE.request 6.3.5.2.1 Function This primitive requests authentication with a specified peer MAC entity. 6.3.5.2.2 Semantics of the service primitive The primitive parameters are as follows: MLME-AUTHENTICATE.request( PeerSTAAddress, AuthenticationType, AuthenticateFailureTimeout, Content of FT Authentication elements, Content of SAE Authentication Frame, FILS wrapped data, VendorSpecificInfo ) Name Type range Description PeerSTAAddress MACAddress Any individual MAC address Specifies the address of the peer MAC entity with which to perform the authentication process. AuthenticationType Enumeration OPEN_SYSTEM, SHARED_KEY, FAST_BSS_TRANSITION, SAE, FILS Specifies the type of authentication algorithm to use during the authentication process.