IEEE 802.11w-2009

Current 802.11 standard defines "frame" types for use in management and control of wireless links. IEEE 802.11w is the Protected Management Frames standard for the IEEE 802.11 family of standards. Task Group 'w' worked on improving the IEEE 802.11 Medium Access Control layer.[1] Its objective was to increase security by providing data confidentiality of management frames, mechanisms that enable data integrity, data origin authenticity, and replay protection. These extensions interact with IEEE 802.11r and IEEE 802.11u.

It is infeasible/not possible to protect the frame sent before four-ways handshake because it is sent prior to key establishment. The management frames, which are sent after key establishment, can be protected.

Infeasible to protect:

• Beacon and probe request/response
• Announcement traffic indication message (ATIM)
• Authentication
• Association request/response
• Spectrum management action

Protection-capable management frames are those sent after key establishment that can be protected using existing protection key hierarchy in 802.11 and its amendments.

Only TKIP/AES frames are protected and WEP/open frames are not protected.

The following management frames can be protected:

• Disassociate
• Deauthenticate
• Action Frames: Block ACK Request/Response (AddBA), QoS Admission Control, Radio Measurement, Spectrum Management, Fast BSS Transition
• Channel Switch Announcement directed to a client (Unicast)

Management frames that are required before AP and client have exchanged the transmission keys via the 4 way handshake remain unprotected:

• Beacons
• Probes
• Authentication
• Association
• Announcement Traffic Indication Message
• Channel Switch Announcement as Broadcast

Uni-cast Protection-capable Management Frames are protected by the same cipher suite as an ordinary data MPDU.

• MPDU payload is TKIP or CCMP encrypted.
• MPDU payload and header are TKIP or CCMP integrity protected.
• Protected frame field of frame control field is set.
• Only cipher suites already implemented are required.
• Sender's pairwise temporal key (PTK) protects unicast management frame.

Broad-/Multicast Robust Management Frames are protected using Broadcast/multicast integrity protocol (BIP)

• Use Integrity Group Temporal Key (IGTK) received during WPA key handshake
• Use Information Element: Management MIC IE with Sequence Number + Cryptographic Hash (AES128-CMAC based)

Replay protection is provided by already existing mechanisms. Specifically, there is a (per-station, per-key, per-priority) counter for each transmitted frame; this is used as a nonce/initialization vector (IV) in cryptographic encapsulation/decapsulation, and the receiving station ensures that the received counter is increasing.

The 802.11w amendment is implemented in Linux and BSD's as part of the 80211mac driver code base, which is used by several wireless driver interfaces; i.e., ath9k. The feature is easily enabled in most kernels and Linux OS's using these combinations. OpenWrt in particular provides an easy toggle as part of the base distribution. The feature has been implemented for the first time into Microsoft operating systems in Windows 8. This has caused a number of compatibility issues particularly with wireless access points that are not compatible with the standard. Rolling back the wireless adapter driver to one from Windows 7 usually fixes the issue.

Wireless LANs without this standard send system management information in unprotected frames, which makes them vulnerable. This standard protects against network disruption caused by malicious systems that forge disassociation requests (deauth) that appear to be sent by valid equipment [2] such as Evil Twin attacks.

• IEEE 802.11i Enhanced Security
• IEEE 802.11r Fast BSS Transition
• IEEE 802.11u Interworking with non-802.11 networks

• Status of the project 802.11w IEEE Task Group w (TGw)
• Tutorial on 802.11w
• Cisco 802.11r, 802.11k, and 802.11w Deployment Guide, Cisco IOS-XE Release 3.3 Chapter: 802.11w Protected Management Frames