RADIUS-Assisted Companion PSK Discovery: Enabling WPA3- SAE in Externally Authenticated Multi-PSK (ePSK / MPSK / DPSK / iPSK / PPSK) Deployments
Azif Abdul Salam Kolisam Beevi, Anil Kumar Reddy, Niraj Lochan Mahapatra
Abstract
Large multi-dwelling unit (MDU), student-housing and hospitality networks rarely store resident preshared keys (PSKs) on the access point (AP). Instead, the per-resident keys of an ePSK, MPSK, DPSK,
iPSK or PPSK service are held in an external RADIUS server or a cloud database that is synchronised
with the property-management system. In our earlier work, "Companion-BSSID Assisted PSK
Discovery: Enabling WPA3-SAE in Multi-PSK (ePSK / MPSK / DPSK / iPSK) Community-Wide WiFi Deployments" (CAPD), we showed that WPA3-SAE can be brought to multi-PSK networks by
learning the client's PSK on a WPA2-only companion BSSID and steering the client with IEEE 802.11v
to a hidden WPA2/WPA3 primary BSSID (the configured WLAN profile) of the same SSID. That
scheme assumes the AP can test every PSK itself. This paper removes that assumption. We propose
RADIUS-Assisted Companion PSK Discovery (RA-CAPD). The AP forwards the ANonce, the raw
EAPOL-Key message 2 (SNonce, MIC, RSNE), the SSID, the client MAC, the BSSID and the AP
MAC to the external server in RADIUS vendor-specific attributes (VSAs). The server performs MIC
validation against all provisioned keys, identifies the matching PSK, and returns it to the AP encrypted
under the RADIUS shared secret (or a per-AP key for cloud databases), together with the unit, room or
user identity and the VLAN. The AP binds the client to this PSK and identity, synchronises the binding
to every AP in the domain, and moves the client to the configured profile. 802.11v-capable clients are
steered with a BSS Transition Management request; other clients are disconnected so that they
reconnect to it. On the configured profile, SAE-capable clients complete WPA3-SAE and WPA2-only
clients complete WPA2-PSK, both with the learned key and no further search. The companion BSSID
is therefore used only for onboarding. The design, attribute dictionary, algorithms, complexity and
security properties are presented, together with laboratory validation on commercial access points.