FILS SHARED KEY CRYPTO OFFLOAD(9)

💅 FILS SHARED KEY CRYPTO OFFLOAD 💅

okay so bestie, we're in the Kernel API Manual, section 9, and today's main character is FILS shared key crypto offload (FILS shared ...ypto offload(9) — yes the header truncates it, that's just how the header do). grab a strawberry drink 🍓 and let's get into it.

✨ THE WHOLE SITUATION (DESCRIPTION) ✨

first things first, bestie: this feature is applicable to drivers running in AP mode. AP mode only. that's the vibe check it has to pass. 🫶

drivers can advertise FILS shared key crypto offload by setting the NL80211_EXT_FEATURE_FILS_CRYPTO_OFFLOAD flag. iconique. and the drivers that support FILS shared key crypto offload should be able to encrypt and decrypt association frames for FILS shared key authentication as per IEEE 802.11ai. like, that's the whole assignment, no cap.

with this capability, for FILS key derivation, drivers depend on userspace. the drivers do not derive the key themselves — they're not that girl, and they know it. 😌

after FILS key derivation, userspace shares the FILS AAD details with the driver and the driver stores the same to use in decryption of association request and in encryption of association response. lowkey the driver is just holding the notes for userspace. 📝

the below parameters should be given to the driver in NL80211_CMD_SET_FILS_AAD:

• NL80211_ATTR_MAC — STA MAC address, used for storing FILS AAD per STA 🎀
• NL80211_ATTR_FILS_KEK — used for encryption or decryption 🔐
• NL80211_ATTR_FILS_NONCES — used for encryption or decryption (STA Nonce 16 bytes followed by AP Nonce 16 bytes) ✨

ngl the nonces one has a whole little order to it — STA nonce first, 16 bytes, then AP nonce, 16 bytes. don't shuffle them, bestie. that's not a vibe, that's a bug. 💀

once the association is done, the driver cleans the FILS AAD data. it's giving responsible adult. tidy up, log off, periodt. 🧹

🌈 SEE ALSO 🌈

okay this is the big one, the link dump, the group chat with everyone in it. every single one of these, bestie — I would never skip a name. 💖

• Kernel file ./include/uapi/linux/nl80211.h 📁
• Station handling(9)
• Frame transmission/registration support(9)
• Virtual interface / concurrency capabilities(9)
• packet coalesce support(9)
• WPA/WPA2 EAPOL handshake offload(9)
• FILS shared key authentication offload(9)
• SAE authentication offload(9)
• VLAN offload support for setting group keys and binding STAs to VLANs(9)
• TID configuration(9)
• Multi-Link Operation(9)
• OWE DH IE handling offload(9)
• enum nl80211_commands(9)
• enum nl80211_attrs(9)
• enum nl80211_iftype(9)
• enum nl80211_sta_flags(9)
• enum nl80211_sta_p2p_ps_status(9)
• struct nl80211_sta_flag_update(9)
• enum nl80211_he_gi(9)
• enum nl80211_he_ltf(9)
• enum nl80211_he_ru_alloc(9)
• enum nl80211_eht_gi(9)
• enum nl80211_eht_ltf(9)
• enum nl80211_eht_ru_alloc(9)
• enum nl80211_rate_info(9)
• enum nl80211_sta_bss_param(9)
• enum nl80211_sta_info(9)
• enum nl80211_tid_stats(9)
• enum nl80211_txq_stats(9)
• enum nl80211_mpath_flags(9)
• enum nl80211_mpath_info(9)
• enum nl80211_band_iftype_attr(9)
• enum nl80211_band_attr(9)
• enum nl80211_nan_phy_cap_attr(9)
• enum nl80211_wmm_rule(9)
• enum nl80211_frequency_attr(9)
• enum nl80211_bitrate_attr(9)
• enum nl80211_reg_initiator(9)
• enum nl80211_reg_type(9)
• enum nl80211_reg_rule_attr(9)
• enum nl80211_sched_scan_match_attr(9)
• enum nl80211_reg_rule_flags(9)
• enum nl80211_dfs_regions(9)
• enum nl80211_user_reg_hint_type(9)
• enum nl80211_survey_info(9)
• enum nl80211_mntr_flags(9)
• enum nl80211_mesh_power_mode(9)
• enum nl80211_meshconf_params(9)
• enum nl80211_mesh_setup_params(9)
• enum nl80211_txq_attr(9)
• enum nl80211_channel_type(9)
• enum nl80211_key_mode(9)
• enum nl80211_chan_width(9)
• enum nl80211_bss_scan_width(9)
• enum nl80211_bss_use_for(9)
• enum nl80211_bss_cannot_use_reasons(9)
• enum nl80211_bss(9)
• enum nl80211_bss_status(9)
• enum nl80211_auth_type(9)
• enum nl80211_key_type(9)
• enum nl80211_mfp(9)
• enum nl80211_key_default_types(9)
• enum nl80211_key_attributes(9)
• enum nl80211_tx_rate_attributes(9)
• struct nl80211_txrate_vht(9)
• struct nl80211_txrate_he(9)
• struct nl80211_txrate_eht(9)
• enum nl80211_band(9)
• enum nl80211_ps_state(9)
• enum nl80211_attr_cqm(9)
• enum nl80211_cqm_rssi_threshold_event(9)
• enum nl80211_tx_power_setting(9)
• enum nl80211_tid_config(9)
• enum nl80211_packet_pattern_attr(9)
• struct nl80211_pattern_support(9)
• enum nl80211_wowlan_triggers(9)
• TCP connection wakeup(9)
• struct nl80211_wowlan_tcp_data_seq(9)
• struct nl80211_wowlan_tcp_data_token(9)
• struct nl80211_wowlan_tcp_data_token_feature(9)
• enum nl80211_wowlan_tcp_attrs(9)
• struct nl80211_coalesce_rule_support(9)
• enum nl80211_attr_coalesce_rule(9)
• enum nl80211_coalesce_condition(9)
• enum nl80211_iface_limit_attrs(9)
• enum nl80211_if_combination_attrs(9)
• enum nl80211_plink_state(9)
• enum nl80211_plink_action(9)
• enum nl80211_rekey_data(9)
• enum nl80211_hidden_ssid(9)
• enum nl80211_sta_wme_attr(9)
• enum nl80211_pmksa_candidate_attr(9)
• enum nl80211_tdls_operation(9)
• enum nl80211_ap_sme_features(9)
• enum nl80211_feature_flags(9)
• enum nl80211_ext_feature_index(9)
• enum nl80211_probe_resp_offload_support_attr(9)
• enum nl80211_connect_failed_reason(9)
• enum nl80211_timeout_reason(9)
• enum nl80211_scan_flags(9)
• enum nl80211_acl_policy(9)
• enum nl80211_smps_mode(9)
• enum nl80211_radar_event(9)
• enum nl80211_dfs_state(9)
• enum nl80211_protocol_features(9)
• enum nl80211_crit_proto_id(9)
• enum nl80211_rxmgmt_flags(9)
• struct nl80211_vendor_cmd_info(9)
• enum nl80211_tdls_peer_capability(9)
• enum nl80211_sched_scan_plan(9)
• struct nl80211_bss_select_rssi_adjust(9)
• enum nl80211_bss_select_attr(9)
• enum nl80211_nan_function_type(9)
• enum nl80211_nan_publish_type(9)
• enum nl80211_nan_func_term_reason(9)
• enum nl80211_nan_func_attributes(9)
• enum nl80211_nan_srf_attributes(9)
• enum nl80211_nan_match_attributes(9)
• enum nl80211_nan_band_conf_attributes(9)
• enum nl80211_nan_conf_attributes(9)
• enum nl80211_external_auth_action(9)
• enum nl80211_ftm_responder_attributes(9)
• enum nl80211_preamble(9)
• enum nl80211_peer_measurement_type(9)
• enum nl80211_peer_measurement_status(9)
• enum nl80211_peer_measurement_req(9)
• enum nl80211_peer_measurement_resp(9)
• enum nl80211_peer_measurement_ftm_req_type(9)
• enum nl80211_peer_measurement_peer_attrs(9)
• enum nl80211_peer_measurement_attrs(9)
• enum nl80211_peer_measurement_ftm_capa(9)
• enum nl80211_peer_measurement_ftm_type_capa(9)
• enum nl80211_peer_measurement_ftm_req(9)
• enum nl80211_peer_measurement_ftm_failure_reasons(9)
• enum nl80211_peer_measurement_ftm_resp(9)
• enum nl80211_obss_pd_attributes(9)
• enum nl80211_bss_color_attributes(9)
• enum nl80211_iftype_akm_attributes(9)
• enum nl80211_fils_discovery_attributes(9)
• enum nl80211_unsol_bcast_probe_resp_attributes(9)
• enum nl80211_sae_pwe_mechanism(9)
• enum nl80211_sar_type(9)
• enum nl80211_sar_attrs(9)
• enum nl80211_sar_specs_attrs(9)
• enum nl80211_mbssid_config_attributes(9)
• enum nl80211_ap_settings_flags(9)
• enum nl80211_wiphy_radio_attrs(9)
• enum nl80211_wiphy_radio_freq_range(9)
• enum nl80211_s1g_short_beacon_attrs(9)
• enum nl80211_nan_capabilities(9)
• enum nl80211_nan_peer_map_attrs(9)

and that's the whole page, bestie!! 🦋 before you go — this one lives at ./include/uapi/linux and it's dated October 2026, still answering to the name FILS shared ...ypto offload(9). mwah, go encrypt something 💜🎀