FILS SHARED KEY AUTHENTICATION OFFLOAD(9)

📦 version 7.3.1, in nixpkgs unstable

✨ FILS shared key authentication offload ✨

okay so bestie, welcome to the Kernel API Manual page for FILS shared ...tion offload(9) — yes that's the real truncated name, we don't make the rules 💅. This is the one about letting your wifi driver do the FILS shared key auth thing all by itself.

🎀 DESCRIPTION 🎀

So here's the vibe: drivers can advertise FILS shared key authentication offload by setting the NL80211_EXT_FEATURE_FILS_SK_OFFLOAD flag. That's the whole flex — a little feature bit that says "yeah, I got this".

And the drivers that actually support FILS shared key authentication offload? They should be able to construct the authentication and association frames for FILS shared key authentication and eventually do a key derivation as per IEEE 802.11ai. Iconic behavior, no notes.

Now the below additional parameters should be given to the driver in NL80211_CMD_CONNECT and/or in NL80211_CMD_UPDATE_CONNECT_PARAMS:

  • NL80211_ATTR_FILS_ERP_USERNAME — used to construct keyname_nai
  • NL80211_ATTR_FILS_ERP_REALM — used to construct keyname_nai
  • NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM — used to construct erp message
  • NL80211_ATTR_FILS_ERP_RRK — used to generate the rIK and rMSK. rIK should be used to generate an authentication tag on the ERP message, and rMSK should be used to derive a PMKSA.
🫶 fr fr: rIK, rMSK should be generated and keyname_nai, sequence number should be used as specified in IETF RFC 6696. That's not a suggestion, that's the spec, bestie.

🌸 the other direction (driver ➡️ userspace) 🌸

When FILS shared key authentication is completed, the driver needs to provide the below additional parameters to userspace — and this can be either after setting up a connection or after roaming:

  • NL80211_ATTR_FILS_KEK — used for key renewal
  • NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM — used in further EAP-RP exchanges
  • NL80211_ATTR_PMKID — used to identify the PMKSA used/generated
  • Nl80211_ATTR_PMK — used to update PMKSA cache in userspace

And the PMKSA can be maintained in userspace persistently so that it can be used later after reboots or wifi turn off/on also. The way that survives a reboot 😭✨

🦋 the cache id moment 🦋

NL80211_ATTR_FILS_CACHE_ID is the cache identifier advertised by a FILS capable AP supporting PMK caching. It specifies the scope within which the PMKSAs are cached in an ESS.

NL80211_CMD_SET_PMKSA and NL80211_CMD_DEL_PMKSA are enhanced to allow support for PMKSA caching based on FILS cache identifier. Additionally, NL80211_ATTR_PMK is used with NL80211_SET_PMKSA to specify the PMK corresponding to a PMKSA for the driver to use in a FILS shared key connection with PMKSA caching. Highkey a whole ecosystem 🧚

👑 SEE ALSO 👑

Kernel file ./include/uapi/linux/nl80211.h and also, like, all of these — yes there's a lot, don't come for me, I'm just the messenger 💀:

  • Station handling(9)
  • Frame transmission/registration support(9)
  • Virtual interface / concurrency capabilities(9)
  • packet coalesce support(9)
  • WPA/WPA2 EAPOL handshake offload(9)
  • SAE authentication offload(9)
  • VLAN offload support for setting group keys and binding STAs to VLANs(9)
  • TID configuration(9)
  • FILS shared key crypto offload(9)
  • Multi-Link Operation(9)
  • OWE DH IE handling offload(9)
  • enum nl80211_commands(9)
  • enum nl80211_attrs(9)
  • enum nl80211_iftype(9)
  • enum nl80211_sta_flags(9)
  • enum nl80211_sta_p2p_ps_status(9)
  • struct nl80211_sta_flag_update(9)
  • enum nl80211_he_gi(9)
  • enum nl80211_he_ltf(9)
  • enum nl80211_he_ru_alloc(9)
  • enum nl80211_eht_gi(9)
  • enum nl80211_eht_ltf(9)
  • enum nl80211_eht_ru_alloc(9)
  • enum nl80211_rate_info(9)
  • enum nl80211_sta_bss_param(9)
  • enum nl80211_sta_info(9)
  • enum nl80211_tid_stats(9)
  • enum nl80211_txq_stats(9)
  • enum nl80211_mpath_flags(9)
  • enum nl80211_mpath_info(9)
  • enum nl80211_band_iftype_attr(9)
  • enum nl80211_band_attr(9)
  • enum nl80211_nan_phy_cap_attr(9)
  • enum nl80211_wmm_rule(9)
  • enum nl80211_frequency_attr(9)
  • enum nl80211_bitrate_attr(9)
  • enum nl80211_reg_initiator(9)
  • enum nl80211_reg_type(9)
  • enum nl80211_reg_rule_attr(9)
  • enum nl80211_sched_scan_match_attr(9)
  • enum nl80211_reg_rule_flags(9)
  • enum nl80211_dfs_regions(9)
  • enum nl80211_user_reg_hint_type(9)
  • enum nl80211_survey_info(9)
  • enum nl80211_mntr_flags(9)
  • enum nl80211_mesh_power_mode(9)
  • enum nl80211_meshconf_params(9)
  • enum nl80211_mesh_setup_params(9)
  • enum nl80211_txq_attr(9)
  • enum nl80211_channel_type(9)
  • enum nl80211_key_mode(9)
  • enum nl80211_chan_width(9)
  • enum nl80211_bss_scan_width(9)
  • enum nl80211_bss_use_for(9)
  • enum nl80211_bss_cannot_use_reasons(9)
  • enum nl80211_bss(9)
  • enum nl80211_bss_status(9)
  • enum nl80211_auth_type(9)
  • enum nl80211_key_type(9)
  • enum nl80211_mfp(9)
  • enum nl80211_key_default_types(9)
  • enum nl80211_key_attributes(9)
  • enum nl80211_tx_rate_attributes(9)
  • struct nl80211_txrate_vht(9)
  • struct nl80211_txrate_he(9)
  • struct nl80211_txrate_eht(9)
  • enum nl80211_band(9)
  • enum nl80211_ps_state(9)
  • enum nl80211_attr_cqm(9)
  • enum nl80211_cqm_rssi_threshold_event(9)
  • enum nl80211_tx_power_setting(9)
  • enum nl80211_tid_config(9)
  • enum nl80211_packet_pattern_attr(9)
  • struct nl80211_pattern_support(9)
  • enum nl80211_wowlan_triggers(9)
  • TCP connection wakeup(9)
  • struct nl80211_wowlan_tcp_data_seq(9)
  • struct nl80211_wowlan_tcp_data_token(9)
  • struct nl80211_wowlan_tcp_data_token_feature(9)
  • enum nl80211_wowlan_tcp_attrs(9)
  • struct nl80211_coalesce_rule_support(9)
  • enum nl80211_attr_coalesce_rule(9)
  • enum nl80211_coalesce_condition(9)
  • enum nl80211_iface_limit_attrs(9)
  • enum nl80211_if_combination_attrs(9)
  • enum nl80211_plink_state(9)
  • enum nl80211_plink_action(9)
  • enum nl80211_rekey_data(9)
  • enum nl80211_hidden_ssid(9)
  • enum nl80211_sta_wme_attr(9)
  • enum nl80211_pmksa_candidate_attr(9)
  • enum nl80211_tdls_operation(9)
  • enum nl80211_ap_sme_features(9)
  • enum nl80211_feature_flags(9)
  • enum nl80211_ext_feature_index(9)
  • enum nl80211_probe_resp_offload_support_attr(9)
  • enum nl80211_connect_failed_reason(9)
  • enum nl80211_timeout_reason(9)
  • enum nl80211_scan_flags(9)
  • enum nl80211_acl_policy(9)
  • enum nl80211_smps_mode(9)
  • enum nl80211_radar_event(9)
  • enum nl80211_dfs_state(9)
  • enum nl80211_protocol_features(9)
  • enum nl80211_crit_proto_id(9)
  • enum nl80211_rxmgmt_flags(9)
  • struct nl80211_vendor_cmd_info(9)
  • enum nl80211_tdls_peer_capability(9)
  • enum nl80211_sched_scan_plan(9)
  • struct nl80211_bss_select_rssi_adjust(9)
  • enum nl80211_bss_select_attr(9)
  • enum nl80211_nan_function_type(9)
  • enum nl80211_nan_publish_type(9)
  • enum nl80211_nan_func_term_reason(9)
  • enum nl80211_nan_func_attributes(9)
  • enum nl80211_nan_srf_attributes(9)
  • enum nl80211_nan_match_attributes(9)
  • enum nl80211_nan_band_conf_attributes(9)
  • enum nl80211_nan_conf_attributes(9)
  • enum nl80211_external_auth_action(9)
  • enum nl80211_ftm_responder_attributes(9)
  • enum nl80211_preamble(9)
  • enum nl80211_peer_measurement_type(9)
  • enum nl80211_peer_measurement_status(9)
  • enum nl80211_peer_measurement_req(9)
  • enum nl80211_peer_measurement_resp(9)
  • enum nl80211_peer_measurement_ftm_req_type(9)
  • enum nl80211_peer_measurement_peer_attrs(9)
  • enum nl80211_peer_measurement_attrs(9)
  • enum nl80211_peer_measurement_ftm_capa(9)
  • enum nl80211_peer_measurement_ftm_type_capa(9)
  • enum nl80211_peer_measurement_ftm_req(9)
  • enum nl80211_peer_measurement_ftm_failure_reasons(9)
  • enum nl80211_peer_measurement_ftm_resp(9)
  • enum nl80211_obss_pd_attributes(9)
  • enum nl80211_bss_color_attributes(9)
  • enum nl80211_iftype_akm_attributes(9)
  • enum nl80211_fils_discovery_attributes(9)
  • enum nl80211_unsol_bcast_probe_resp_attributes(9)
  • enum nl80211_sae_pwe_mechanism(9)
  • enum nl80211_sar_type(9)
  • enum nl80211_sar_attrs(9)
  • enum nl80211_sar_specs_attrs(9)
  • enum nl80211_mbssid_config_attributes(9)
  • enum nl80211_ap_settings_flags(9)
  • enum nl80211_wiphy_radio_attrs(9)
  • enum nl80211_wiphy_radio_freq_range(9)
  • enum nl80211_s1g_short_beacon_attrs(9)
  • enum nl80211_nan_capabilities(9)
  • enum nl80211_nan_peer_map_attrs(9)
🍓 and that's the whole page, bestie! This one lives in ./include/uapi/linux, dated October 2026 — so yeah she's from the future and she's slaying. mwah 💖
📦 where this page comes from