topic PPSK and 6GHz in ExtremeCloud IQ

PPSK and 6GHz

JA — Wed, 26 Jul 2023 16:18:45 GMT

I was reading in the latest version of the XIQ User Guide and it stated

"Private Pre-Shared Key requires users to authenticate by entering a PPSK unique to each user (not available for 6 GHz)."

Does anyone know if use in 6GHz something that may be added later?

Thanks

Re: PPSK and 6GHz

Jan_Reister — Thu, 27 Jul 2023 12:41:09 GMT

WPA3 is mandatory in 6GHz, no other method (e.g.WPA, WPA2,WEP) is allowed.

PPSK relies on WPA2 Personal, because WPA2 P. allows the reverse-engineering of the passphrase based on it contributing to the master session key. WPA3 does not allow that.

Jan

Re: PPSK and 6GHz

JA — Thu, 27 Jul 2023 13:12:31 GMT

Thank you Jan.

I wonder if there is a replacement in the works for something similar that will work with WPA3?

Thanks again.

Re: PPSK and 6GHz

daniel1 — Fri, 28 Jul 2023 07:23:45 GMT

So when WPA2 retires there will be no more PPSK technology?

Re: PPSK and 6GHz

Jan_Reister — Fri, 28 Jul 2023 10:41:02 GMT

PPSK in WPA2 Personal can be implemented by the AP in two ways:

based on the client device MAC address - fails with MAC address randomization
based on the individual PSK that the client uses in the 4-way handshake to derive the encryption keys - does not work in WPA3 Personal

The only way I see for this to work in 6GHz is some proprietary implementation of WPA2 Personal outside of the IEEE 802.11ax standard and of the Wi-Fi Alliance certifications. One may question if this is worth the trouble.

Jan

Re: PPSK and 6GHz

JA — Fri, 28 Jul 2023 14:42:01 GMT

Thanks again Jan.

Re: PPSK and 6GHz

LaurentA — Wed, 17 Sep 2025 15:30:53 GMT

Hi,

Are there any plan at Extreme to support PPSK in WPA3 ?

I know that SAE prevent using pre-calculated hash like in WPA2, but it looks like that some vendors are working on association between MAC Addresses and PPSK in WPA3.

This way SAE can be achieve (because the AP can choose the proper PPSK associated with the client MAC Address, and realize the correct calculation).

I know that MAC Randomisation can be tricky, but in some scenario this is something we can accept (in coWorking or Students environment, we can indicate users how to disable randomisation on specific SSID for instance)...

Thanks,
Laurent.