Encrypting data in a pre-associated state
In some examples, an access point (AP) receives, from a wireless device during a pre-associated state between the AP and the wireless device, a request, a first value, and an encrypted version of the first value. The AP sends, to the wireless device during the pre-associated state, an encrypted version of a second value relating to an encryption key that is based on the first value, and a response to the request, the response encrypted using the encryption key.
1. A method of an access point (AP), comprising:
performing protected pre-association communications between the AP and a wireless device;
transmitting in a beacon a protected pre-association communications indicator, the protected pre-association communications indicator indicating support by the AP for communication of protected data during a pre-associated state between the AP and the wireless device;
receiving, from the wireless device during the pre-associated state, a message after the transmitting of the beacon, the message including a request, the message indicating support by the wireless device for the communication of protected data during the pre-associated state;
generating, at the AP, a public-private key pair and a symmetric key; and
sending, from the AP to the wireless device during the pre-associated state, a response to the request, the response comprising an encrypted version of the symmetric key,
wherein;
the AP determines, based on the received message, that the wireless device supports the communication of protected data during the pre-associated state, and
wherein the generating of the symmetric key and the sending of the response comprising the encrypted version of the symmetric key is responsive to the determining that the wireless device supports the communication of protected data during the pre-associated state.
2. The method of claim 1 , wherein the public-private key pair comprises a public key and a private key.
3. The method of claim 2 , wherein the encrypted version of the symmetric key is based on encrypting the symmetric key using the private key.
4. The method of claim 1 , wherein the request is an Access Network Query Protocol (ANQP) request, and the response is an ANQP response.
5. The method of claim 1 , wherein the request and the response comprise fine timing measurement (FTM) messages.
6. The method of claim 1 , wherein the response is carried by a public action frame comprising a Public Action Encrypted Payload element.
7. The method of claim 1 , further comprising:
communicating, between the AP and the wireless device, an error code indicating an error associated with the encrypted version of the symmetric key.
8. An access point (AP) comprising:
a communication transceiver to communicate with a wireless device; and
at least one processor configured to:
perform protected pre-association communications between the AP and the wireless device;
transmit in a beacon a protected pre-association communications indicator, the protector pre-association communications indicator indicating support by the AP for communication of protected data during a pre-associated state between the AP and the wireless device;
receive, from the wireless device during the pre-associated state, a message after the transmitting of the beacon, the message including a request, the message indicating support by the wireless device for the communication of protected data during the pre-associated state;
determine based on the received message, that the wireless device supports the communication of protected data during the pre-associated state;
generate, at the AP, a public-private key pair and a symmetric key; and
send, to the wireless device during the pre-associated state, a response to the request, the response comprising an encrypted version of the symmetric key,
wherein the generating of the symmetric key and the sending of the response comprising the encrypted version of the symmetric key is responsive to the determining that the wireless device supports the communication of protected data during the pre-associated state.
9. The AP of claim 8 , wherein the encrypted version of the symmetric key is based on encrypting the symmetric key using a public key of the public-private key pair.
10. The AP of claim 8 , wherein the encrypted version of the symmetric key is based on encrypting the symmetric key using a private key of the public-private key pair.
11. The AP of claim 8 , wherein the request is an Access Network Query Protocol (ANQP) request, and the response is an ANQP response.
12. A wireless device comprising:
a communication transceiver to communicate with an access point (AP); and
at least one processor configured to:
perform protected pre-association communications between the wireless device and the AP;
receive, from the AP, a beacon comprising a protected pre-association communications indicator, the protected pre-association communications indicator indicating support by the AP for communication of protected data during a pre-associated state between the AP and the wireless device;
after the receiving of the beacon, send, to the AP during the pre-associated state, a message, the message including a request, the message indicating support by the wireless device for the communication of protected data during the pre-associated state; and
receive, at the wireless device from the AP during the pre-associated state, a response to the request, the response comprising an encrypted version of a symmetric key generated by the AP that also generated a public-private key pair, wherein the AP is to generate the symmetric key and send the response comprising the encrypted version of the symmetric key responsive to the AP determining, based on the message, that the wireless device supports the communication of protected data during the pre-associated state.
13. The wireless device of claim 12 , wherein the encrypted version of the symmetric key is based on encrypting the symmetric key using a private key of the public-private key pair.
14. The wireless device of claim 12 , wherein the request is an Access Network Query Protocol (ANQP) request, and the response is an ANQP response.
15. A method comprising:
performing protected pre-association communications between a wireless device and an access point (AP);
receiving, by the wireless device from the AP, a beacon comprising a protected pre-association communications indicator, the protected pre-association communications indicator indicating support by the AP for communication of protected data during a pre-associated state between the AP and the wireless device;
after the receiving of the beacon, sending, by the wireless device to the AP during the pre-associated state, a message, the message including a request, the message indicating support by the wireless device for the communication of protected data during the re-associated state; and
receiving, by the wireless device from the AP during the pre-associated state, a response to the request, the response comprising an encrypted version of a symmetric key generated by the AP that also generated a public-private key pair, wherein the AP is to generate the symmetric key and send the response comprising the encrypted version of the symmetric key responsive to the AP determining, based on the message, that the wireless device supports the communication of protected data during the pre-associated state.
16. The method of claim 15 , further comprising deriving, by the wireless device, the symmetric key based on the encrypted version of the symmetric key in the response.