Skip to content
View in the app

A better way to browse. Learn more.

Armbian Community Forums

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Wi-Fi chip information and WPA3 compatibility

Featured Replies

In this topic I'll share information from Wi-Fi modules found in SBCs, and their compatibility with WPA3 standard.

 

 

WPA3-Personal Only (not Transitional or Compatible)

Wi-Fi 5 (ac), 6 (ax), 7 (be) on 2.4 and 5 GHz:

  • Authentication and Key Management (AKM): WPA3-SAE with SHA256 (AKM:8, AKM:9 FT), optionally WPA3-SAE with a variable hash algorithm depending on Diffie-Hellman (DH) group SHA-256, SHA-384, or SHA-512 (AKM:24, AKM:25 FT)
  • Key derivation methods: Hunting and Pecking (HnP) or Hash-to-Element (H2E)
  • Pairwise cipher (PTK): CCMP-128, optionally GCMP-256, others possible but not TKIP
  • Group data cipher (GTK): CCMP-128, optionally GCMP-256, others possible but not TKIP
  • Group management cipher (IGTK): BIP-CMAC-128, optionally BIP-GMAC-256
  • Protected Management Frames (PMF/802.11w): required

 

Wi-Fi 6 ax @ 6 GHz / Wi-Fi 7 be @ 6 GHz OR with Multi-Link Operation (MLO):

  • Authentication and Key Management (AKM): WPA3-SAE with a variable hash algorithm depending on Diffie-Hellman (DH) group SHA-256, SHA-384, or SHA-512 (AKM:24, AKM:25 FT)
  • Key derivation methods: Hash-to-Element (H2E)
  • Pairwise cipher (PTK): GCMP-256 required, CCMP-128 optional, others possible but not TKIP
  • Group data cipher (GTK): GCMP-256 required, CCMP-128 optional, others possible but not TKIP
  • Group management cipher (IGTK): the same as non-6GHz (??) BIP-CMAC-128, optionally BIP-GMAC-256
  • Protected Management Frames (PMF/802.11w): required

 

WPA3-Enterprise Only (not Transitional or Compatible)

Wi-Fi 5 (ac), 6 (ax), 7 (be) on 2.4 and 5 GHz:

Same as for Personal, but:

  • Authentication and Key Management (AKM): At least WPA3 AKM:5 (IEEE 802.1X with SHA-256)
  • Group management cipher (IGTK): BIP-CMAC-128, optionally BIP-GMAC-256, additional optional BIP-CMAC-256 and BIP-GMAC-128

 

Wi-Fi 6 ax @ 6 GHz / Wi-Fi 7 be @ 6 GHz OR with Multi-Link Operation (MLO):

Same additional Key Deviation and GCMP constrains as for Personal.


WPA3-Enterprise 192-bit mode

 

Same as for Personal + Enterprise, but:

 

  • Authentication and Key Management (AKM): only WPA3 AKM:12 (Suite B 192b, IEEE 802.1X with SHA-384). WPA-EAP-SUITE-B-192 in key_mgmt output.
  • Pairwise cipher (PTK): GCMP-256 only
  • Group data cipher (GTK): GCMP-256 mandatory, others optional
  • Group management cipher (IGTK): BIP-GMAC-256 mandatory, others optional

 

Source: https://www.wi-fi.org/system/files/WPA3 Specification v3.5.pdf

 

 

Edited by ValdikSS

  • Author

My tests:

 

1. Get information of the adapter capabilities with:

iw phy

 

2. Get pairwise/group ciphers, supported key management and authentication algorithms with:

for i in eap pairwise group key_mgmt proto auth_alg channels freq modes; do
  CAPABILITY="$(wpa_cli get_capability $i | grep -v 'Selected interface')"
  echo "get_capability $i:"
  echo "$CAPABILITY"
  echo
done

 

3. Connect to WPA3-Personal Only network and check the information about connected client on the router.

 

 

Caveats you should be aware of

 

wpa_supplicant creates key_mgmt from the chip's cipher list if the chip does not return key_mgmt. It's filled from the presets and miss for example WPA-EAP-SHA256 needed for WPA3-Enterprise. Most probably it will work even if it's not listed.

 

To detect whether key_mgmt you see is from chip or filled from the template, run

wpa_supplicant ... -d | grep 'supported key_mgmt'

If you don't see this string in the output, this means the key_mgmt is filled from the template.

Edited by ValdikSS

  • Author

Radxa Zero 3w.

AIC8800D80 — 2.4 + 5 GHz 802.11b/g/n/ac/ax 80 MHz 1x1 + BT5.3.

Datasheet.

 

✔️ Works in WPA3-Personal Only: WPA3-SAE + CCMP-128 for pairwise/group ciphers.

✔️ Should work in WPA3-Enterprise Only: will connect if the AP supports CCMP-128 for pairwise/group ciphers.
❌ Does not work for WPA3-Enterprise 192-bit mode (no support for GCMP-256, no support for WPA-EAP-SUITE-B-192 key_mgmt).

 

Tested on Armbian 26.8.1 (Armbian_26.8.1_Radxa-zero3_trixie_vendor_6.1.115_minimal.img.xz).

More information in the attachment.

 

Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 3
        max scan IEs length: 200 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports RSN-IBSS.
        Device supports AP-side u-APSD.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * CMAC (00-0f-ac:6)
                * WPI-SMS4 (00-14-72:1)
        Available Antennas: TX 0 RX 0
        Supported interface modes:
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * mesh point
                 * P2P-client
                 * P2P-GO
                 * P2P-device
…

get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
CCMP TKIP

get_capability group:
CCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B OWE DPP FT-PSK FT-EAP

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP SAE

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14
Mode[A] Channels: 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14

get_capability modes:
AP MESH

 

 

Router data, 802.11k/v and PMF supported, WPA3-SAE connection.

 

          station: 
                  mac: xx:xx:xx:xx:xx:xx
                   ap: WifiMaster0/AccessPoint0
                  psm: no
        authenticated: yes
               txrate: 65
               rxrate: 65
               uptime: 410
              txbytes: 18787
              rxbytes: 27140
                   ht: 20
                 mode: 11n
                   gi: 800
                 rssi: -57
                  mcs: 7
                 txss: 1

                  _11: k

                  _11: v

                  pmf: yes
             security: wpa3-psk

 

 

 

radxa-zero-3w-AIC8800D80.zip

 

 

 

 

Edited by ValdikSS

  • Author

Orange Pi 3G-IoT-A.

MT6620 (?) Wi-FI inside Mediatek MT6572 smartphone chip.

 

❌ Does not work in WPA3-Personal Only: no WPA3-SAE support

✔️ Should work in WPA3-Enterprise Only: will connect if the AP supports CCMP-128 for pairwise/group ciphers.

❌ Does not work for WPA3-Enterprise 192-bit mode: no PMF no GCMP support

 

I've applied this patch to kernel 3.4 to enable PMF, IEEE 802.1X with SHA-256 support was already in the driver.

This confirms that WPA3-Enterprise is possible even on ancient kernels/modules and does not require anything special besides PMF.

 

Tested on Armbian 24.xx

More information in the attachment.

 

 

orange-pi-3g-iot-mtk.zip

Edited by ValdikSS

  • Author

Orange Pi Zero3.

CDTech CDW-20U5622 / AllWinner AW859, Unisoc UWE5622 (sc2355) chip: 2.4, 5 GHz 802.11a/b/g/n/ac 1x1 MU-MIMO, Bluetooth 5.0

Datasheet.

 

❌ Does not work in WPA3-Personal Only: no WPA3-SAE support

🤷 Maybe it supports WPA3-Enterprise AKM:5 (IEEE 802.1X with SHA-256), don't know the method to check

❌ Does not work for WPA3-Enterprise 192-bit mode: no support for GCMP-256, no support for WPA-EAP-SUITE-B-192 key_mgmtno WPA3-SAE support

 

Supports PMF for WPA2-PSK Station, but fails to configure AP with PMF.

 

Tested on Armbian 24.xx
More information in the attachment.

 

Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 12
        max scan IEs length: 2304 bytes
        max # sched scan SSIDs: 9
        max # match sets: 9
        RTS threshold: 2353
        Retry short limit: 10
        Retry long limit: 9
        Coverage class: 0 (up to 0m)
        Device supports RSN-IBSS.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * WPI-SMS4 (00-14-72:1)
                * CMAC (00-0f-ac:6)
                * 00-0f-ac:255
        Available Antennas: TX 0x1 RX 0x1
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * P2P-client
                 * P2P-GO
                 * P2P-device
…

get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
CCMP TKIP

get_capability group:
CCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B OWE DPP FT-PSK FT-EAP

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14
Mode[A] Channels: 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14

get_capability modes:
IBSS AP

 

 

orange-pi-zero3-uwe5622.zip

Edited by ValdikSS

  • Author

Continuing.

 

Radxa Rock Pi S.

Realtek RTL8723DS, 2.4GHz 1T1R 802.11bgn SDIO WLAN with Bluetooth 4.2 Single-Chip Controller

Datasheet.

 

 

Proprietary Realtek 8723ds driver (v5.1.1.5_20523.20161209_BTCOEX20161208-1212, year 2016)

 

❌ Does not work in WPA3-Personal Only: no WPA3-SAE support, no PMF support (no CMAC support)

❌ Does not work in WPA3-Enterprise (IEEE 802.1X with SHA-256): no PMF support (no CMAC support)

❌ Does not work for WPA3-Enterprise 192-bit mode: no support for GCMP-256, no support for WPA-EAP-SUITE-B-192 key_mgmt, no PMF support (no CMAC support)

 

Tested on Radxa Rock Pi S image, Wed, 24 Jan 2024
More information in the attachment.

 

Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 9
        max scan IEs length: 2304 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
        Available Antennas: TX 0 RX 0
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * P2P-client
                 * P2P-GO
…


get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
CCMP TKIP

get_capability group:
CCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B OWE DPP FT-PSK FT-EAP

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13

get_capability modes:
IBSS AP


Router:
                   ap: WifiMaster0/AccessPoint0
                  psm: no
        authenticated: yes
               txrate: 65
               rxrate: 52
               uptime: 10
              txbytes: 6438
              rxbytes: 1460
                   ht: 20
                 mode: 11n
                   gi: 800
                 rssi: -55
                  mcs: 7
                 txss: 1

                  _11: k

             security: wpa2-psk

 

 

Mainline rtw88 rtw_8723ds driver (SoftMAC driver, supports any feature the kernel/wpa_supplicant supports. Kernel 6.1):

 

✔️ Works in WPA3-Personal Only: WPA3-SAE + CCMP-128/GCMP-128/GCMP-256 for pairwise/group ciphers.

✔️ Should work in WPA3-Enterprise Only: will connect if the AP supports CCMP-128 or GCMP-256 for pairwise/group ciphers.
✔️ Works for WPA3-Enterprise 192-bit mode (supports GCMP-256).

 

Tested on Radxa Rock Pi S image, Wed, 24 Jan 2024
More information in the attachment.

 

Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 4
        max scan IEs length: 2257 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports T-DLS.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * CCMP-256 (00-0f-ac:10)
                * GCMP-128 (00-0f-ac:8)
                * GCMP-256 (00-0f-ac:9)
                * CMAC (00-0f-ac:6)
                * CMAC-256 (00-0f-ac:13)
                * GMAC-128 (00-0f-ac:11)
                * GMAC-256 (00-0f-ac:12)
…

get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
CCMP-256 GCMP-256 CCMP GCMP TKIP

get_capability group:
CCMP-256 GCMP-256 CCMP GCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B WPA-EAP-SUITE-B-192 OWE DPP FILS-SHA256 FILS-SHA384 FT-FILS-SHA256 FT-FILS-SHA384 FT-PSK FT-EAP SAE

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP SAE FILS_SK_WITHOUT_PFS FILS_SK_WITH_PFS

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13 14

get_capability modes:
IBSS AP


Router:
                   ap: WifiMaster0/AccessPoint0
                  psm: no
        authenticated: yes
               txrate: 65
               rxrate: 72
               uptime: 451
              txbytes: 13352
              rxbytes: 3779
                   ht: 20
                 mode: 11n
                   gi: 800
                 rssi: -58
                  mcs: 7
                 txss: 1

                  _11: k

                  _11: r

                  _11: v

                  pmf: yes
             security: wpa3-psk

 

radxa-rock-pi-s-rtl8723ds.zip

Edited by ValdikSS

  • Author

Wukong Pi, an Orange Pi Zero LTS clone.

AllWinner XR819, 2.4GHz 1T1R 802.11bgn. 

Datasheet.

 

 

Open https://github.com/fifteenhex/xradio Armbian SoftMAC driver (1 Sep 2026), supports everything Linux kernel and wpa_supplicant supports.

 

✔️ Works in WPA3-Personal Only: WPA3-SAE + CCMP-128/GCMP-128/GCMP-256 for pairwise/group ciphers.

✔️ Should work in WPA3-Enterprise Only: will connect if the AP supports CCMP-128 or GCMP-256 for pairwise/group ciphers.
✔️ Works for WPA3-Enterprise 192-bit mode (supports GCMP-256).

 

Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 2
        max scan IEs length: 2257 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports AP-side u-APSD.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * CCMP-256 (00-0f-ac:10)
                * GCMP-128 (00-0f-ac:8)
                * GCMP-256 (00-0f-ac:9)
                * CMAC (00-0f-ac:6)
                * CMAC-256 (00-0f-ac:13)
                * GMAC-128 (00-0f-ac:11)
                * GMAC-256 (00-0f-ac:12)
…

get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
CCMP-256 GCMP-256 CCMP GCMP TKIP

get_capability group:
CCMP-256 GCMP-256 CCMP GCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B WPA-EAP-SUITE-B-192 OWE DPP FILS-SHA256 FILS-SHA384 FT-FILS-SHA256 FT-FILS-SHA384 FT-PSK FT-EAP SAE

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP SAE FILS_SK_WITHOUT_PFS FILS_SK_WITH_PFS

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13

get_capability modes:
IBSS AP MESH


Router:
                   ap: WifiMaster0/AccessPoint0
                  psm: no
        authenticated: yes
               txrate: 65
               rxrate: 65
               uptime: 223
              txbytes: 8617
              rxbytes: 4220
                   ht: 20
                 mode: 11n
                   gi: 800
                 rssi: -51
                  mcs: 7
                 txss: 1

                  _11: k

                  _11: v

                  pmf: yes
             security: wpa3-psk

 

Tested on Armbian sunxi 26.11.0-trunk.40 (fc4623bc6), 6.18.49-current-sunxi
More information in the attachment.

 

 

orange-pi-zero-xr819.zip

Edited by ValdikSS

  • Author

ArmSoM P2pro.

Ampak AP6256, Synaptics SYN43456 (Broadcom licensee, BCM43456). 2.4, 5 GHz 802.11a/b/g/n/ac 1x1 SISO, UART/PCM for Bluetooth 5.2

Datasheets: [1], [2]

 

 

bcmdhd module @ Kernel 5.10.110, firmware: Aug 25 2022 12:38:28 version 7.45.96.150 (g31bd2ca8) FWID 01-af0bb8b0 es7.c5.n4.a3

 

❌ Does not work in WPA3-Personal Only: fails to associate, seems to be a known bug in driver/firmware, affects Raspberry Pi 4/5 as well

✔️ Should work in WPA3-Enterprise (supports PMF, CCMP-128 and GCMP-256 for pairwise/group ciphers)

✔️ Should work in WPA3-Enterprise 192-bit mode (supports PMF, GCMP-256, WPA-EAP-SUITE-B-192)

 

Confirmed SAE not working for BCM/SYN43456 also on Raspberry Pi 400 (Raspberry OS, kernel 6.18.39), Orange Pi 4a (Armbian kernel 7.1.13, AurealNix v0.4.1 kernel 6.18.44).

 

 

# iw phy
Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 10
        max scan IEs length: 2048 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports roaming.
        Device supports T-DLS.
        Supported Ciphers:
                * WEP40 (00-0f-ac:1)
                * WEP104 (00-0f-ac:5)
                * TKIP (00-0f-ac:2)
                * CCMP-128 (00-0f-ac:4)
                * CMAC (00-0f-ac:6)
                * GMAC-256 (00-0f-ac:12)
                * GMAC-128 (00-0f-ac:11)
                * CMAC-256 (00-0f-ac:13)
                * 00-90-4c:0
                * GCMP-128 (00-0f-ac:8)
                * GCMP-256 (00-0f-ac:9)
                * GMAC-128 (00-0f-ac:11)
                * GMAC-256 (00-0f-ac:12)
        Available Antennas: TX 0x1 RX 0x1
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * P2P-client
                 * P2P-GO
                 * P2P-device
…

get_capability eap:
MD5 TLS WFA-UNAUTH-TLS MSCHAPV2 PEAP TTLS GTC OTP SIM LEAP PSK AKA AKA' FAST PAX SAKE GPSK WSC IKEV2 TNC PWD EKE

get_capability pairwise:
GCMP-256 CCMP GCMP TKIP

get_capability group:
GCMP-256 CCMP GCMP TKIP WEP104 WEP40

get_capability key_mgmt:
NONE IEEE8021X WPA-EAP WPA-PSK WPA-EAP-SUITE-B WPA-EAP-SUITE-B-192 OWE DPP FT-PSK

get_capability proto:
RSN WPA

get_capability auth_alg:
OPEN SHARED LEAP SAE

get_capability channels:
Mode[G] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13
Mode[A] Channels: 36 40 44 48 52 56 60 64 149 153 157 161 165
Mode[B] Channels: 1 2 3 4 5 6 7 8 9 10 11 12 13

get_capability modes:
IBSS AP


Router:
          station: 
                  mac: b8:13:32:cf:b4:e4
                   ap: WifiMaster1/AccessPoint0
                  psm: no
        authenticated: yes
               txrate: 60
               rxrate: 54
               uptime: 773
              txbytes: 159775
              rxbytes: 26650656
                   ht: 40
                 mode: 11ac
                   gi: 400
                 rssi: -79
                  mcs: 3
                 txss: 1
                  ebf: yes
                dl-mu: no

                  _11: k

                  _11: r

                  pmf: yes
             security: wpa2-psk

 

Tested on armsom-p2pro-debian-bullseye-base-arm64-20241101 image.
More information in the attachment.

 

armsom-p2pro-ap6256.zip

 

Edited by ValdikSS

Board: Orange Pi 5B (RK3588S) — onboard AP6275P module
Chip: Broadcom BCM43752 802.11ax 2×2 dual-band, PCIe (14e4:449d rev 02); BT 5.x on UART
OS / kernel: Ubuntu 24.04 (Pi Desktop, ubuntu-rockchip lineage), vendor BSP 6.1 — not Armbian, but the same vendor WiFi stack Armbian's vendor-rk35xx kernels carry
Driver: vendor bcmdhd 101.10.591.52.27 (2024-04); ethtool -i reports wl — not brcmfmac. Firmware wl0: Jul 12 2022 version 18.35.387.23.146 (g412cc5ec) FWID 01-93c53be6
Supplicant: wpa_supplicant 2.10 · NetworkManager 1.46

iw phy (security-relevant):


Supported Ciphers: WEP40, WEP104, TKIP, CCMP-128, CMAC, GMAC-256, GMAC-128, CMAC-256, GCMP-128, GCMP-256
Device supports SAE with AUTHENTICATE command
interface modes: IBSS, managed, AP, P2P-client, P2P-GO, P2P-device · HE MAC caps present (802.11ax)
wpa_cli get_capability:


key_mgmt:   … FT-SAE SAE OWE WPA-EAP-SUITE-B-192 WPA-PSK-SHA256 WPA-EAP-SHA256 …
pairwise:   GCMP-256 CCMP GCMP TKIP
group_mgmt: AES-128-CMAC BIP-GMAC-128 BIP-GMAC-256 BIP-CMAC-256
auth_alg:   OPEN SHARED LEAP SAE
WPA3-Personal only (SAE, PMF required): ✅ works


key_mgmt=SAE  pmf=2  pairwise_cipher=CCMP  group_cipher=CCMP  wpa_state=COMPLETED  freq=5745
signal -47 dBm · tx bitrate 433.0 MBit/s · DHCP lease obtained, gateway reachable
WPA3-Enterprise: not tested (no RADIUS in this lab)
WPA3-Enterprise 192-bit: not tested — the required cipher set (GCMP-256 + BIP-GMAC-256 + SUITE-B-192 AKM) is advertised by both driver and supplicant

Test environment: UniFi UDM SE, test SSID set to WPA3-only / PMF Required, 5 GHz ch 149

Notes for other OPi 5B owners: iw is missing from some images (apt install iw). The same module's Bluetooth side has a long-standing firmware-load/coex race on this board — fixes and an auto-heal service live in the Pi Desktop repo.

  • Author
11 часов назад, defcom5-rockchip сказал:

Board: Orange Pi 5B (RK3588S) — onboard AP6275P module
Chip: Broadcom BCM43752 802.11ax 2×2 dual-band, PCIe (14e4:449d rev 02); BT 5.x on UART

Could you please post the output of `iw dev` and wpa_cli commands, as I do? The raw output is useful for the future reference.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

Account

Navigation

Search

Search

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.