10 ms·
Hold on there: WPA3 connections fail after 11 hours
- HenryBemis 3y ago"It's not a bug, it's a feature". This way we know you are really serious of keeping the thing going, by making sure that every 11 hours you are THERE by "turning it off and on again" (to quote the the IT Crowd)
- develatio 3y agoThis is the hardware version of Netflix's "Are you still watching?"
- pierat 3y agoOr another reason to go with a real computer on eBay vs a RPi and loads of other equipment.
- Jabrov 3y agoAccording to the article, this has nothing to do with Pi and is more about WPA3 itself
- vlovich123 3y agoUnclear if WPA3 or this specific Infineon chip. Most likely it’s a chip issue where some counter overflows or something and suddenly the crypto starts failing.
- MBCook 3y agoMy read was it’s the chip/driver combo. And the Pi is not the only thing to use that chip, it’s just very popular. So even if one’s attitude is “get a real computer” like the first post in this thread you may still find yourself with this same chip.
- tialaramex 3y agoI can easily buy either 1. The chip works perfectly but it's documented badly/ wrongly, e.g. doesn't spell out the whole strategy needed for a periodic key renewal or does so confusingly - driver is written to match the docs or at least the best understanding of these docs, and unfortunately this defect arises after 10 hours but devs with the actual docs have never tested for that long. 2. The chip has a bug, it's not possible to use it correctly per se. Every few hours, just reset it and start over, thus a "good" driver should do resets when quiescent. e.g. After 2 hours, if you did no work for 60 seconds, reset it, after 4 hours make that 15 seconds, after 6 hours, 5 seconds, after 7 hours immediately on quiescence, and after 8 hours just reset immediately rather than wait for the bug. [Edited to fix numerous typographical errors]
- tamimio 3y agoAlthough I don’t think this issue relates to the pi, but I agree, some people think pis will do anything and everything just because you managed to hack some components together, sure, it might works but it isn’t reliable, build a proper computer for that task and save yourself the trouble.
- Levitating 3y agoYes, curse these low power cheap system on a chips! All embedded software should be run on x86! Routers on x86, phones on x86, smart thermostats on x86. Just buy them on eBay am I right.
- aleph_minus_one 3y ago> All embedded software should be run on x86! Routers on x86, phones on x86, smart thermostats on x86. In 2013, Intel made an attempt to make x86 suitable for embedded purposes with the Intel Quark microcontroller: > https://en.wikipedia.org/wiki/Intel_Quark https://en.wikipedia.org/wiki/Intel_Quark and branded developer boards for it under the name Intel Galileo: > https://en.wikipedia.org/wiki/Intel_Galileo https://en.wikipedia.org/wiki/Intel_Galileo As far as I aware the markets rather preferred existing microcontroller solutions instead of Intel's offer.
- fifteen1506 3y agoMaybe they'll try again with x86s.
- topspin 3y agoMCUs are all about peripherals. The ISA barely matters. The peripherals are frequently ported forward unchanged or enhanced in forward compatible ways from older MCUs with different ISAs because they are specialized, proprietary, carefully refined circuits and developers can port their working C peripheral drivers with minimal change. You can't helicopter in to that market with your half baked, brand new peripheral suite and expect everyone to adopt it. Intel did go far in set top boxes and smart TVs with their atom/canmore (SoC, not MCU) platform in ~2008 and onward. I ported some media software to it. I think a lot of that has been given back to ARM and Android since, however.
- postepowanieadm 3y ago"cheap"
- toast0 3y agoIntel kind of abandoned embedded recently, but 80186 was x86 for embedded before it was cool. And they've tried to make it work from time to time. x86 routers are great. x86 phones aren't awful, and could have been amazing if Intel didn't cancel them right before Microsoft released Continuum. Not sure if I've seen a smart thermostat on x86, but I dunno sure, as long as its got a common wire do it can pull power, should be fine.
- NoZebra120vClip 3y ago"Here's a nickel, kid." http://www.miketaylor.org.uk/tech/eta/doc/dilbert.gif http://www.miketaylor.org.uk/tech/eta/doc/dilbert.gif
- throw0101d 3y ago> The thread runs for close to a year, and then just stops cold in August 2022 with no resolution. "Who were you, DenverCoder9? What did you see?" * https://xkcd.com/979/ https://xkcd.com/979/
- toyg 3y agoSome datascientist out there should crunch the numbers and give us the probability that an XKCD link will appear in any given HN post. I bet it's fairly close to 1. One day we will have an "XKCD number", to represent how far from an XKCD reference any existing concept is.
- chaboud 3y agoMaybe the useful XKCD number would be the proportion of comments before and after the first XKCD reference? There’s also the “true XKCD percentage”, which could exceed 1 for highly XKCD’d topics.
- toyg 3y ago> the useful XKCD number would be the proportion of comments before and after the first XKCD reference That would be XKCD velocity, I guess.
- ploum 3y agoVelocity is indeed a nice idea. According to XKCD’s law, the probability to have an xkcd reference is proportional to the number of comments (see https://ploum.net/xkcds-law/index.html https://ploum.net/xkcds-law/index.html ) But adding velocity is really nice. Should think more about it…
- deleted 3y ago[deleted]
- amenghra 3y agoI don't consider myself a datascientist but I did some HN x XKCD analysis a while ago. The HN dataset is hosted on Google BigQuery and it is included in some TB per month of free tier processing you get. I.e. you can answer your question quite easily. See my stuff if you are interested: https://www.quaxio.com/hackernews_xkcd_citations/ https://www.quaxio.com/hackernews_xkcd_citations/
- dmorgan81 3y ago11 hours = 39,600 seconds Max signed int16 = 32,767 Maybe a signed overflow?
- stevewodil 3y agoWhat happened to the other two hours
- rubatuga 3y agoJust a reminder that the original ath9k driver supports WPA3 and 802.11s mesh without any hacks. The open source wifi ecosystem is not cursed... although we are stuck with old hardware.
- throw0101d 3y agoOne hypothesis: the cipher needs regular key rotation? E.g. (not what WPA3 actually does): > Encryption keys should be changed (or rotated) based on a number of different criteria: (...) After the key has been used to encrypt a specific amount of data. This would typically be 2^35 bytes (~34GB) for 64-bit keys and 2^68 bytes (~295 exabytes) for 128 bit keys. * https://security.stackexchange.com/questions/259808/why-should-encryption-key-be-rotated-after-it-has-been-used-to-encrypt-a-specifi https://security.stackexchange.com/questions/259808/why-shou... Though this would be bit-dependent and not time-dependent. I'm guessing that this likely some kind of 'uptime bug': * https://en.wikipedia.org/wiki/Integer_overflow https://en.wikipedia.org/wiki/Integer_overflow
- genewitch 3y agoi highly doubt they sent 34GB in 11 hours - or, put another way, sent 34GB consistently ever 11 hours such that the keys were exhausted after the same amount of time. This isn't a smart washing machine we're talking about here, just [a] raspberry pi(s)
- Jtsummers 3y agoIn exactly 11 hours on three devices, in particular. On one device, the first time it fails after 11 hours could be a coincidence (unlikely, but possible) but repeatedly happening across all three devices suggests something entirely different.
- DannyBee 3y agoGTK rekey interval is time dependent. Most AP's set it to 3600 seconds by default.
- londons_explore 3y agoWhy are we allowing anyone to use 64 bit keys in 2024? Why is it even part of the WPA3 spec? To be honest, whoever wrote that bit of the spec should have 'probably part of a three letter agency, don't trust what they say' to the top of their Wikipedia page.
- natch 3y agoBut is there an automatable workaround? Even a 'no' to this question would be a useful addition to this article.
- genewitch 3y agoyes, but it's relatively uninteresting; you could just reboot every 10 hours and 59 minutes, for example. You could check the outuput of a ping command and if it stops giving new sequence numbers or whatever ifupdown the interface, and so on.
- natch 3y agoSo say a scripted reboot, like in a cron job, is that what you're talking about? Automatable is important. I suppose the script would have to run as root or with suid root? And thanks for the reply.
- simcop2387 3y agoI would probably use a systemd timer instead because it has a feature that most crons don't. You can tell it to start the reboot 10 hours and 55 minutes after the timer was started, regardless of time of day or other clock concerns. that means you don't need valid global time or anything to schedule it properly and it'll be built in to the already there raspberry pi os (and most other distros for the pi) so there's no new software to install or setup.
- natch 3y agoThanks!
- JoBrad 3y agoOr could you just establish a new connection on the same cadence?
- clhodapp 3y agoPosting workarounds is quite fraught because as soon as you say that there's a workaround, upstream responses tend to immediately become "has workaround, wontfix"
- jandrese 3y agoDamn, I was hoping this was going to be a thread about the guy who tracked down the bug in that damn chip and fixed it with some binary patch even though the vendor was completely useless.
- redundantly 3y agoI'd like to read that.
- LoganDark 3y agoI know, right?
- DannyBee 3y agoReading that thread, it's failing to rekey properly. The rekey interval is probably set to 3600 seconds, something dumb breaks after the 10th rekey (36000 seconds), and so when the 11th rekey interval comes around at the 11th hour (39600 seconds) and it hasn't re-key'd, the authentication ends up no longer valid and it disconnects. Easy way to test this theory: Set the re-key interval on the AP to like 10 seconds, see if it disconnects after 110 seconds.
- k_sze 3y agosounds like a 16-bit int overflow?
- Jtsummers 3y agoA signed 16-bit integer rolls over after 32767, which is a little after 9 hours and 6 minutes (if we're tracking seconds). An unsigned 16-bit integer rolls over at 18:12 and change. Neither fits the observed 11 hour mark.
- vlovich123 3y agoHW often used counters to represent multiple seconds so I was thinking something like a 32 bit counter representing the number of 10us elapsed which comes out to just over 11 hours. Hard to say though since no obvious counter comes out to 11 hours. That being said, a counter of some kind going wrong would be the most obvious reason to experience an issue. Maybe there’s a WiFi frame counter that participates in ratcheting the key used to encrypt each frame or something.
- Thri4895o 3y ago> Broadcom/Cypress/Infineon CYW stuff > My conclusion: this entire ecosystem is deeply cursed There is no curse, but cheap junk sold for premium price! Those components are designed for cheap laptops and tvs. Building networks and servers out of this foolish! If you want stable WiFi, get Intel card connected over Pcie, not USB! It is like 20 USD with official WPA3 support!
- mardifoufs 3y agoUh? I thought Broadcom and Infineon made very solid stuff...
- Thri4895o 3y agoPi is build from cheapest components! Broadcom is famous for their terrible Linux support (typical android style binary firmware blob dump). Many drivers are unofficial, only reverse engineered. Some commenter here even mentions patching binary blobs to fix issues! Murata Type1GC mentioned here, goes back to 2015. It also has several compromises to keep size small. Hardly stellar config!
- azinman2 3y agoWell the Pi isn’t trying to be expensive or high end. But it’s generally pretty stable tho. What would you recommend instead that fulfills a similar role?
- 1oooqooq 3y agoit's not like you have an option (out of china)
- aidos 3y agoQuestion for those with more experience - I’ve just purchased a Pi Zero 2 and I’ve been having real issues with the WiFi since I opened the box. Is it likely a faulty device?
- drewg123 3y agoI have seen issues with apple (Mac and iPhone) devices loosing connectivity on wpa2 after each rekey. Symptom is the device drops offline for several seconds, sometimes connecting another network if one is available. This wreaks havoc with FaceTime calls. I’ve also seen iPhones drop off wifi entirely if another network is not available until you disable and re-enable wifi I found that extending the rekey interval makes it happen less. I think i set the interval to something very large
- poyu 3y agoI’ve always thought this is due to Wi-Fi Assist [0] being less than helpful? Never tested any further though [0]: https://support.apple.com/en-us/102228 https://support.apple.com/en-us/102228
- drewg123 3y agoI don't think that is the problem, just something that kicks in after the problem has happened and wifi has disappeared. Eg, on my macbook, I was loosing wifi every hour before I tweaked the settings on the router.
- secondcoming 3y agoThis happens on my iPad also at around the same time each night! I thought it was my router being bad.
- Scene_Cast2 3y agoI recently found out that WPA3 and especially WPA2/WPA3 mixed were having issues with WiFi roaming - as in, with 2 access points, devices were not switching from one to another unless one of them just drops the client to force a reassociation. I ended up just using WPA2, as I don't have any 6GHz or WiFi 7 APs.
- barbegal 3y agoI suspect that this patch https://w1.fi/cgit/hostap/commit/?id=b0f457b6191aa8ee329331ccbe0600326f7b1e2e https://w1.fi/cgit/hostap/commit/?id=b0f457b6191aa8ee329331c... may fix the issue although the default key lifetime is 12 hours not 11 but maybe there is something which runs every hour and checks which keys will expire within the next hour. New technology like this is often horrifically under tested and there must be so many bugs for those who go hunting.
- nikanj 3y agoIt's an interesting failure mode of our current economic system that the fix for this issue will inevitably come from a lone frustrated outsider. The employees of the company are much better equipped with all the insider knowledge, blueprints, source codes et cetera. But the incentive models for companies essentially guarantee that they'll never go through the trouble of solving a persistent problem for an already-on-the-market product, if the problem is not big enough to cause a recall or substantial numbers of product returns So our only hope is some amateur sleuth operating from home, stabbing blindly at the card with caffeine and hatred as the only tools in their disposal. But they'll probably solve it, and we'll get to read a cool blog post about it!
- roboman 3y agoI've worked as an engineer in the Wi-Fi industry. Here's my advice: stay at least one or, even better, two generations behind the current Wi-Fi standards. Vendors care about only two things: (1) Cost (2) the Gbps they can print on the box. So today that means 802.11ac and WPA2, unfortunately. Stability of the software is not a consideration.
- itronitron 3y agoI'm the proud owner of a major brand WiFi router, and there is a typo on the admin login screen. Not a good look, but it's the best we've got.
- yjftsjthsd-h 3y agoI would argue that OpenWrt is the best we've got. (I grant that the hardware side remains messy)
- kjs3 3y agoI grant that the hardware side remains messy Other than that, how was the play Mrs Lincoln.
- p1mrx 3y agoYes, but you usually have to choose hardware that's a couple generations behind, in order to run OpenWrt.
- Borealid 3y agoI don't think that's the case, exactly. You can choose current-generation hardware from a company that chooses to implement less advanced wireless specifications. For example, the gl-inet Flint 2 (MT-6000) runs a fork of OpenWRT out of the box and can be flashed with stock OpenWRT snapshots. That's a very modern piece of hardware that will do wifi 6 (not wifi 6E/7). So hardware-wise you get the current gen, software-spec-wise you get one generation behind. I don't think practically speaking you're going to feel much pain from using Wifi 6 for the next few years, as it can saturate a 1Gbps link pretty easily.
- spr-alex 3y agoThere's a misunderstanding in the article and the comments worth clarifying for people on SAE/WPA3 and the 6Ghz/6-E Bands. WPA3 is only required when operating on the 6ghz bands. For 802.11ac/ax its not required on the 5ghz bands. So it is possible to spin up an AP on 6ghz with SAE only, and another AP on 5ghz in WPA2/3 mixed mode. It's not an all or nothing choice for the pi which first of all only supports 802.11ac and secondly does not support 6ghz with the builtin wifi card. In terms of range and capabilities we've found the mt76 series to be very reliable and support wifi6 and 6-e on the pis with speeds easily reaching 600mbps. These are the A8000 cards from netgear and the ALFA AWUS036AXML. They're pretty good for what they are. I only wish they were Dual Band Dual Channel. WiFi 7 will see clients gaining Multi Link Operation capability, they'll be able to simultaneously hit 5ghz and 6ghz and 2.4ghz bands for 2-3x throughput.
- zamalek 3y agoAn alternative to the rekeying interval is potentially a DFS channel being used and a radar or causing a channel switch.
- gustavpaul 3y agoPCAP or it didn't happen
- stein1946 3y agoCan someone explain to me why don't we have open source WiFi chips? Are they so complicated that we can't get a open hardware pcie adapter?
- miah_ 3y agoLikely due to regulations, fcc, certification costs, etc.
- zamadatix 3y agoThe hard part of open hardware isn't the technical complexity by itself. I'd even go so far as to say there is no such thing as something so complicated we can only make a closed implementation of it, just see Linux. The questions are more like "Do you want to fund the hardware investment, including legal certifications since this is consumer radio technology, on the hope it'll sell enough to make it back?", "Do you want to continuously design new versions to new standards every 5 years so it doesn't just become obsolete anyways?", "Do you want to maintain the firmware and driver, answering all of the issues that come about connecting to thousands of other devices across thousands and thousands of pages of standards behavior you or they implement poorly?", and, moreso, "Do you want to do this for the rest of your life all out of principle that client Wi-Fi chips, which the high end of the latest generation go up to a whopping $16.55 per in bulk, sometimes have bugs and you can't go in and just fix the particular bug you want to? Now sure, maybe you can convince your closest 10 dozen friends interested in open source hardware to not put everything on one person but at the end of the day there are a few people it's going to be a significant burden on and they have to see it as a worthwhile burden otherwise nobody is going to run the project. It'd probably be easier (though not easy) to stir up enough support to convince an existing manufacturer to make their firmware open source instead.
- rcxdude 3y agoEven much simpler chip functions tend not to have an open-source implementation. Open-source doesn't mesh very well with the economics of chip fabrication, is the main reason (in general it doesn't work with hardware as well, but chip fabrication is probably the most inaccessible of hardware types). And yes, wifi is complex. Probably the only function more complex is cell phone radios.
- pdonis 3y agoI went "ah, that explains it" when I saw "Broadcom" in the description of the chipset.
- demondemidi 3y agoOn a side note: this person's blog is pretty amazing. Is RachelByTheBay someone famous?
- cat_plus_plus 3y agoAny way to get OpenWrt on Pi to serve WPA3? I was hoping to test WPA3/OWE for a fairly important project, no dice. Timeframe was such that I didn't have time to find another OpenWrt device, so I just hope it works...
- _8j50 3y agoSolution: Disable encryption for WPA3 (open/owe), use wireguard for device -> router connection security.
- rvba 3y agoIs this for that one particular chip, or for every WPA3 device? Imagine having a teams call, or playing a computer game and your brand new router disconnects you every 11 hours. And since 11 hours.. this crash will cycle by 1 hour every day - so sometimes the disconnects are at night but sometimes during the day, so unpredictable (especially as some lack of power resets the clock too).