Currently there is no way to install an LTF key seed that can be used in non-trigger-based (NTB) and trigger-based (TB) FTM ranging to protect NDP frames. Without this, drivers cannot enable PHY-layer security for peer measurement sessions, leaving ranging measurements vulnerable to eavesdropping and manipulation. Introduce NL80211_KEY_LTF_SEED attribute and the dedicated extended feature flag NL80211_EXT_FEATURE_SET_KEY_LTF_SEED to allow drivers to advertise and install LTF key seeds via nl80211. The key seed must be configured beforehand to ensure the peer measurement session is secure. The driver must advertise both NL80211_EXT_FEATURE_SECURE_LTF and NL80211_EXT_FEATURE_SET_KEY_LTF_SEED for the key seed installation to be permitted. The LTF key seed is pairwise key material and must only be used with pairwise key type. Reject attempts to use it with other key types.
Showing the changes to include/uapi (1 of 5 files). Show all
Unified · Split
| @@ -5814,6 +5814,18 @@ enum nl80211_key_default_types { · 5813 unmodified lines | |||
| 5814 | * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode. | 5814 | * @NL80211_KEY_MODE: the mode from enum nl80211_key_mode. |
| 5815 | * Defaults to @NL80211_KEY_RX_TX. | 5815 | * Defaults to @NL80211_KEY_RX_TX. |
| 5816 | * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key | 5816 | * @NL80211_KEY_DEFAULT_BEACON: flag indicating default Beacon frame key |
| 5817 | * @NL80211_KEY_LTF_SEED: LTF key seed is used by the driver to generate | ||
| 5818 | * secure LTF keys used in case of peer measurement request with FTM | ||
| 5819 | * request type as either %NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED | ||
| 5820 | * or %NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED. Secure LTF key seeds | ||
| 5821 | * will help enable PHY security in peer measurement session. | ||
| 5822 | * The LTF key seed is installed along with the TK (Temporal Key) using | ||
| 5823 | * %NL80211_CMD_NEW_KEY. The TK is configured using the | ||
| 5824 | * %NL80211_ATTR_KEY_DATA attribute, while the LTF key seed is configured | ||
| 5825 | * using this attribute. Both keys must be configured before initiation | ||
| 5826 | * of peer measurement to ensure peer measurement session is secure. | ||
| 5827 | * Only valid if %NL80211_EXT_FEATURE_SET_KEY_LTF_SEED is set. This | ||
| 5828 | * attribute is restricted to pairwise keys (%NL80211_KEYTYPE_PAIRWISE). | ||
| 5817 | * | 5829 | * |
| 5818 | * @__NL80211_KEY_AFTER_LAST: internal | 5830 | * @__NL80211_KEY_AFTER_LAST: internal |
| 5819 | * @NL80211_KEY_MAX: highest key attribute | 5831 | * @NL80211_KEY_MAX: highest key attribute |
| @@ -5830,6 +5842,7 @@ enum nl80211_key_attributes { · 10 unmodified lines | |||
| 5830 | NL80211_KEY_DEFAULT_TYPES, | 5842 | NL80211_KEY_DEFAULT_TYPES, |
| 5831 | NL80211_KEY_MODE, | 5843 | NL80211_KEY_MODE, |
| 5832 | NL80211_KEY_DEFAULT_BEACON, | 5844 | NL80211_KEY_DEFAULT_BEACON, |
| 5845 | NL80211_KEY_LTF_SEED, | ||
| 5833 | 5846 | ||
| 5834 | /* keep last */ | 5847 | /* keep last */ |
| 5835 | __NL80211_KEY_AFTER_LAST, | 5848 | __NL80211_KEY_AFTER_LAST, |
| @@ -7059,6 +7072,10 @@ enum nl80211_feature_flags { · 1223 unmodified lines | |||
| 7059 | * forward frames with a matching MAC address to userspace during | 7072 | * forward frames with a matching MAC address to userspace during |
| 7060 | * the off-channel period. | 7073 | * the off-channel period. |
| 7061 | * | 7074 | * |
| 7075 | * @NL80211_EXT_FEATURE_SET_KEY_LTF_SEED: Driver supports installing the | ||
| 7076 | * LTF key seed via %NL80211_KEY_LTF_SEED. The seed is used to generate | ||
| 7077 | * secure LTF keys for secure LTF measurement sessions. | ||
| 7078 | * | ||
| 7062 | * @NUM_NL80211_EXT_FEATURES: number of extended features. | 7079 | * @NUM_NL80211_EXT_FEATURES: number of extended features. |
| 7063 | * @MAX_NL80211_EXT_FEATURES: highest extended feature index. | 7080 | * @MAX_NL80211_EXT_FEATURES: highest extended feature index. |
| 7064 | */ | 7081 | */ |
| @@ -7139,6 +7156,7 @@ enum nl80211_ext_feature_index { · 74 unmodified lines | |||
| 7139 | NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION, | 7156 | NL80211_EXT_FEATURE_ASSOC_FRAME_ENCRYPTION, |
| 7140 | NL80211_EXT_FEATURE_IEEE8021X_AUTH, | 7157 | NL80211_EXT_FEATURE_IEEE8021X_AUTH, |
| 7141 | NL80211_EXT_FEATURE_ROC_ADDR_FILTER, | 7158 | NL80211_EXT_FEATURE_ROC_ADDR_FILTER, |
| 7159 | NL80211_EXT_FEATURE_SET_KEY_LTF_SEED, | ||
| 7142 | 7160 | ||
| 7143 | /* add new features before the definition below */ | 7161 | /* add new features before the definition below */ |
| 7144 | NUM_NL80211_EXT_FEATURES, | 7162 | NUM_NL80211_EXT_FEATURES, |