IEEE 802.11w-2009
$109.42
IEEE Standard for Information technology – Telecommunications and information exchange between systems – Local and metropolitan area networks – Specific requirements. Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications Amendment 4: Protected Management Frames
Published By | Publication Date | Number of Pages |
IEEE | 2009 | 111 |
Amendment Standard – Superseded. This amendment specifies the extensions to IEEE Std 802.11 for wireless local area networks (WLANs) providing mechanisms for protecting management frames.
PDF Catalog
PDF Pages | PDF Title |
---|---|
1 | IEEE Std 802.11w-2009 (Amendment to IEEE Std 802.11-2007), Front cover |
3 | Title page |
6 | Introduction Notice to users Laws and regulations Copyrights Updating of IEEE documents |
7 | Errata Interpretations Patents Participants |
12 | Contents |
19 | List of figures |
20 | List of tables |
21 | Important notice |
22 | 3. Definitions 4. Abbreviations and acronyms 5. General description 5.2 Components of the IEEE 802.11 architecture 5.2.3 Distribution system (DS) concepts 5.2.3.2 RSNA |
23 | 5.4 Overview of the services 5.4.2 Services that support the distribution service 5.4.2.4 Disassociation 5.4.3 Access control and data confidentiality services 5.4.3.2 Deauthentication 5.4.3.3 Data confidentiality |
24 | 5.4.3.4 Key management 5.4.3.5 Data origin authenticity 5.4.3.6 Replay detection 5.4.3.7 Fast BSS transition 5.4.3.8 Robust Management frame protection |
25 | 5.8 IEEE Std 802.11 and IEEE Std 802.1X-2004 5.8.2 Infrastructure functional model overview 5.8.2.1 Authentication and key management (AKM) operations with Authentication Server (AS) |
27 | 5.8.2.2 Operations with PSK 5.8.5 PMKSA caching 5.8.6 Protection of broadcast and multicast Robust Management frames |
28 | 6. MAC service definition 6.1 Overview of MAC services 6.1.2 Security services 7. Frame formats 7.1 MAC Frame formats 7.1.3 Frame fields 7.1.3.1 Frame control field 7.1.3.1.8 Protected Frame field |
29 | 7.2 Format of individual frame types 7.2.3 Management frames 7.2.3.3 Disassociation frame format 7.2.3.5 Association Response frame format |
30 | 7.2.3.7 Reassociation Response frame format 7.2.3.11 Deauthentication |
31 | 7.2.3.12 Action frame format 7.3 Management frame body components 7.3.1 Fields that are not information elements 7.3.1.9 Status Code field |
32 | 7.3.1.11 Action field 7.3.2 Information elements |
34 | 7.3.2.25 RSN information element |
35 | 7.3.2.25.1 Cipher suites |
37 | 7.3.2.25.2 AKM suites 7.3.2.25.3 RSN capabilities |
38 | 7.3.2.48 Fast BSS transition information element (FTIE) |
39 | 7.3.2.49 Timeout Interval information element (TIE) 7.3.2.54 Supported Regulatory Classes element 7.3.2.55 Management MIC information element |
40 | 7.4 Action frame format details 7.4.5 Vendor-specific action details 7.4.7 Public Action details 7.4.7.1 Public Action frames |
41 | 7.4.7.9 DSE Power Constraint frame format 7.4.7.10 Vendor Specific Public Action frame format 7.4.8 Action frame details 7.4.9 SA Query Action frame details 7.4.9.1 SA Query Request frame |
42 | 7.4.9.2 SA Query Response frame 7.4.9a Protected Dual of Public Action frames 7.4.9a.1 Protected Dual of Public Action details |
43 | 7.4.9a.2 Protected DSE Enablement frame format 7.4.9a.3 Protected DSE Deenablement frame format 7.4.9a.4 Protected Extended Channel Switch Announcement frame format 7.4.9a.5 Protected DSE Measurement Request frame format 7.4.9a.6 Protected DSE Measurement Report frame format |
44 | 7.4.9a.7 Protected DSE Power Constraint frame format 8. Security 8.1 Framework 8.1.1 Security methods 8.1.3 RSNA establishment 8.3 RSNA data confidentiality and integrity protocols 8.3.1 Overview |
45 | 8.3.3 CTR with CBC-MAC Protocol (CCMP) 8.3.3.1 CCMP Overview 8.3.3.3 CCMP cryptographic encapsulation 8.3.3.3.2 Construct AAD |
46 | 8.3.3.3.3 Construct CCM nonce 8.3.3.3.5 CCM originator processing 8.3.3.4 CCMP decapsulation |
47 | 8.3.3.4.1 CCM recipient processing 8.3.3.4.3 PN and replay detection 8.3.4 The Broadcast/Multicast integrity protocol |
48 | 8.3.4.1 BIP overview 8.3.4.2 BIP MMPDU format 8.3.4.3 BIP AAD construction 8.3.4.4 BIP replay protection |
49 | 8.3.4.5 BIP transmission 8.3.4.6 BIP reception |
50 | 8.4 RSNA security association management 8.4.1 Security associations 8.4.1.1 Security association definitions 8.4.1.1.3 GTKSA 8.4.1.1.3a IGTKSA 8.4.1.2 Security association life cycle 8.4.1.2.1 Security association in an ESS |
51 | 8.4.3 RSNA policy selection in an ESS |
52 | 8.4.4 RSNA policy selection in an IBSS |
53 | 8.4.6 RSNA authentication in an ESS 8.4.6.1 Preauthentication and RSNA key management 8.4.6.2 Cached PMKSAs and RSNA key management 8.4.9 RSNA key management in an IBSS 8.4.10 RSNA security association termination |
54 | 8.4.11 Protection of Robust Management frames |
55 | 8.4.12 Robust Management frame Selection Procedure 8.5 Keys and key distribution 8.5.1 Key hierarchy 8.5.1.1 PRF |
56 | 8.5.1.2 Pairwise key hierarchy 8.5.1.3 Group key hierarchy 8.5.1.3a Integrity group key hierarchy 8.5.1.4 PeerKey key hierarchy |
57 | 8.5.2 EAPOL-Key frames 8.5.2.1 EAPOL-Key frame notation |
58 | 8.5.3 4-Way Handshake 8.5.3.2 4-Way Handshake Message 2 8.5.3.3 4-Way Handshake Message 3 8.5.3.6 Sample 4-Way Handshake |
59 | 8.5.4 Group Key Handshake |
60 | 8.5.4.1 Group Key Handshake Message 1 8.5.4.4 Sample Group Key Handshake |
61 | 8.5.5 RSNA Supplicant key management state machine |
62 | 8.5.5.2 Supplicant state machine variables 8.5.5.3 Supplicant state machine procedures |
64 | 8.5.6 RSNA Authenticator key management state machine |
66 | 8.6 Mapping EAPOL keys to IEEE 802.11 keys 8.6.3 Mapping PTK to CCMP keys 8.6.6a Mapping IGTK to BIP Keys |
67 | 8.7 Per-frame pseudo-code 8.7.2 RSNA frame pseudo-code 8.7.2.1 Per-MSDU Tx pseudo-code 8.7.2.1a Per-MMPDU Tx pseudo-code |
69 | 8.7.2.2a Per-MPDU Tx pseudo-code for MMPDU 8.7.2.3a Per-MPDU Rx pseudo-code for an MMPDU |
73 | 8.7.2.5 Per-MMPDU Rx pseudo-code |
74 | 10. Layer Management 10.3 MLME SAP interface 10.3.17 SetKeys 10.3.17.1 MLME-SETKEYS.request 10.3.17.1.2 Semantics of the service primitive 10.3.18 DeleteKeys 10.3.18.1 MLME-DELETEKEYS.request 10.3.18.1.2 Semantics of the service primitive 10.3.22 SetProtection 10.3.22.1 MLME-SETPROTECTION.request 10.3.22.1.2 Semantics of the service primitive |
75 | 10.3.39 SA Query support 10.3.39.1 MLME-SAQuery.request 10.3.39.1.1 Function 10.3.39.1.2 Semantics of the service primitive 10.3.39.1.3 When generated 10.3.39.1.4 Effect of receipt 10.3.39.2 MLME-SAQuery.confirm 10.3.39.2.1 Function 10.3.39.2.2 Semantics of the service primitive |
76 | 10.3.39.2.3 When generated 10.3.39.2.4 Effect of receipt 10.3.39.3 MLME-SAQuery.indication 10.3.39.3.1 Function 10.3.39.3.2 Semantics of the service primitive |
77 | 10.3.39.3.3 When generated 10.3.39.3.4 Effect of receipt 10.3.39.4 MLME-SAQuery.response 10.3.39.4.1 Function 10.3.39.4.2 Semantics of the service primitive 10.3.39.4.3 When generated 10.3.39.4.4 Effect of receipt 10.3.40 Protected Extended Channel Switch Announcement |
78 | 10.3.40.1 MLME-PDEXTCHANNELSWITCH.request 10.3.40.1.1 Function 10.3.40.1.2 Semantics of the service primitive 10.3.40.1.3 When generated 10.3.40.1.4 Effect of receipt 10.3.40.2 MLME-PDEXTCHANNELSWITCH.confirm 10.3.40.2.1 Function |
79 | 10.3.40.2.2 Semantics of the service primitive 10.3.40.2.3 When generated 10.3.40.2.4 Effect of receipt 10.3.40.3 MLME-PDEXTCHANNELSWITCH.indication 10.3.40.3.1 Function 10.3.40.3.2 Semantics of the service primitive |
80 | 10.3.40.3.3 When generated 10.3.40.3.4 Effect of receipt 10.3.40.4 MLME-PDEXTCHANNELSWITCH.response 10.3.40.4.1 Function 10.3.40.4.2 Semantics of the service primitive |
81 | 10.3.40.4.3 When generated 10.3.40.4.4 Effect of receipt 10.3.41 Protected DSE Power Constraint Announcement 10.3.41.1 MLME-PDDSETPC.request 10.3.41.1.1 Function 10.3.41.1.2 Semantics of the service primitive |
82 | 10.3.41.1.3 When generated 10.3.41.1.4 Effect of receipt 10.3.41.2 MLME-PDDSETPC.confirm 10.3.41.2.1 Function 10.3.41.2.2 Semantics of the service primitive |
83 | 10.3.41.2.3 When generated 10.3.41.2.4 Effect of receipt 10.3.41.3 MLME-PDDSETPC.indication 10.3.41.3.1 Function 10.3.41.3.2 Semantics of the service primitive 10.3.41.3.3 When generated 10.3.41.3.4 Effect of receipt |
84 | 10.3.41.4 MLME-PDDSETPC.response 10.3.41.4.1 Function 10.3.41.4.2 Semantics of the service primitive 10.3.41.4.3 When generated 10.3.41.4.4 Effect of receipt 10.3.42 Protected Enablement 10.3.42.1 MLME-PDENABLEMENT.request 10.3.42.1.1 Function 10.3.42.1.2 Semantics of the service primitive |
85 | 10.3.42.1.3 When generated 10.3.42.1.4 Effect of receipt 10.3.42.2 MLME-PDENABLEMENT.confirm 10.3.42.2.1 Function 10.3.42.2.2 Semantics of the service primitive |
86 | 10.3.42.2.3 When generated 10.3.42.2.4 Effect of receipt 10.3.42.3 MLME-PDENABLEMENT.indication 10.3.42.3.1 Function 10.3.42.3.2 Semantics of the service primitive |
87 | 10.3.42.3.3 When generated 10.3.42.3.4 Effect of receipt 10.3.42.4 MLME-PDENABLEMENT.response 10.3.42.4.1 Function 10.3.42.4.2 Semantics of the service primitive |
88 | 10.3.42.4.3 When generated 10.3.42.4.4 Effect of receipt 10.3.43 Protected Deenablement 10.3.43.1 MLME-PDDEENABLEMENT.request 10.3.43.1.1 Function 10.3.43.1.2 Semantics of the service primitive 10.3.43.1.3 When generated 10.3.43.1.4 Effect of receipt |
89 | 10.3.43.2 MLME-PDDEENABLEMENT.confirm 10.3.43.2.1 Function 10.3.43.2.2 Semantics of the service primitive 10.3.43.2.3 When generated 10.3.43.2.4 Effect of receipt 10.3.43.3 MLME-PDDEENABLEMENT.indication 10.3.43.3.1 Function |
90 | 10.3.43.3.2 Semantics of the service primitive 10.3.43.3.3 When generated 10.3.43.3.4 Effect of receipt 10.3.44 Vendor Specific Public Action 10.3.44.1 MLME-PVSPECIFIC.request 10.3.44.1.1 Function 10.3.44.1.2 Semantics of the service primitive |
91 | 10.3.44.1.3 When generated 10.3.44.1.4 Effect of receipt 10.3.44.2 MLME-PVSPECIFIC.confirm 10.3.44.2.1 Function 10.3.44.2.2 Semantics of the service primitive |
92 | 10.3.44.2.3 When generated 10.3.44.2.4 Effect of receipt 10.3.44.3 MLME-PVSPECIFIC.indication 10.3.44.3.1 Function 10.3.44.3.2 Semantics of the service primitive 10.3.44.3.3 When generated 10.3.44.3.4 Effect of receipt |
93 | 11. MLME 11.3 STA authentication and association 11.3.1 Authentication and deauthentication 11.3.1.1 Authentication-originating STA 11.3.1.2 Authentication-destination STA 11.3.2 Association, reassociation, and disassociation 11.3.2.2 AP association procedures |
94 | 11.3.2.4 AP reassociation procedures 11.11 DSE procedures 11.11.1 General |
95 | 11.12 Broadcast and multicast Robust Management frame procedures 11.13 SA Query procedures 11A. Fast BSS Transition 11A.2 Key holders 11A.2.2 Authenticator key holders |
96 | 11A.4 FT initial mobility domain association 11A.4.2 FT initial mobility domain association in an RSN |
97 | 11A.5 FT protocol 11A.5.2 Over-the-air FT protocol authentication in an RSN |
98 | 11A.5.3 Over-the-DS FT Protocol authentication in an RSN |
99 | 11A.6 FT Resource Request Protocol 11A.6.2 Over-the-air fast BSS transition with resource request 11A.6.3 Over-the-DS fast BSS transition with resource request |
100 | 11A.7 FT reassociation 11A.7.1 FT reassociation in an RSN 11A.8 FT authentication sequence 11A.8.5 FT authentication sequence: contents of fourth message |
101 | 11A.9 FT security architecture state machines 11A.9.3 R1KH state machine |
103 | Annex A (normative) Protocol Implementation Conformance Statement (PICS) proforma A.4 PICS proforma-IEEE Std 802.11-2007 A.4.4 MAC protocol A.4.4.1 MAC protocol capabilities |
105 | Annex D (normative) ASN.1 encoding of the MAC and PHY MIB |
110 | Annex H (informative) RSNA reference implementations and test vectors H.8 Test vectors for AES-128-CMAC H.9 Management Frame Protection test vectors H.9.1 BIP with broadcast Deauthentication frame |
111 | H.9.2 CCMP with unicast Deauthentication frame |