Does TNGF deliver WPA2-EAP key to Wi-Fi AP?

General Discussions
#1

Dear free5gc community,

I am looking into the TNGF implementation. According to TS 33.501, in a TNGF architecture, the TNGF acts as a Radius server for the Wi-Fi AP, and it delivers a key (K_TNAP) to the Wi-Fi AP, which is then used to setup the 4-way handshake in Wi-Fi to encrypt the layer 2 communications. You can see the authentication workflow in section 7A.2.1.1 here:

https://www.tech-invite.com/3m33/toc/tinv-3gpp-33-501_za.html.

In particular, Step 11, where the WiFi security is established.

My doubt is whether this procedure is supported in the current TNGF implementation in free5gc. If I look at the tutorial (Tngfue installation - free5GC), I can see that TNGF is configured as a Radius server, and the Wi-Fi AP is configured with WPA-EAP security to connect to that Radius server. What is not clear to me is whether the Radius function in the TNGF is independent from the AUSF, or indeed the key delivered by the Radius server is derived from K_TNGF, as stated by the specification.

I would appreciate any clarification

BR

Daniel

#2

Hi,

In our implementation, KTNAP is derived from KTNGF after TNGF receives a 5G-Notification message from the UE.

The relevant code can be found in pkg/radius/handler/handler.go.

image
image1076×411 65.2 KB

After that, KTNAP is encrypted and appended to the packet.

If you have any further questions, feel free to discuss with me.

Best regards,

#3

Hi,

Thanks for the answer.

My understanding is that in addition to the UE, K_TNAP also needs to be delivered to the Wi-Fi AP. Is this done in the procedure indicated in the tutorial for TNGFUE?

BR

Daniel

#4

KTNAP is delivered to the AP in 10d by TNGF.
Ref: https://www.tech-invite.com/3m33/toc/tinv-3gpp-33-501_za.html