WPA3 regression on ESP32 device with 13.3.0?

[schildbach]

I've got a Sonoff M5-3C (ESP32) and I'm pretty sure in some pre-13.3.0 Tasmota it connected to my Wi-Fi router via WPA3. Now, with version 13.3.0, it only connects via WPA2. Is this intentional? Should I open a bug report?

Program Version	13.3.0(tasmota32)
Build Date & Time	2023-12-12T14:31:42
Core/SDK Version	2_0_14/4.4.6.231122
ESP Chip Id	13217284 (ESP32-D0WD-V3 v3.0)
Flash Chip Id	0x16405E (DIO)

[Jason2866]

We have reduced the amount of mbedtls ciphers to reduce flash memory footprint.
This affects the cypher used for WPA3 too. We are checking how much of flash increase does it costs to re-enable the needed one(s) for WPA3. If it consumes to much flash, WPA3 will left disabled.
So, no it is not a bug.

[Kahless2001]

This isn't really ok. If we are going to disable ciphers to save space, we should be removing old broken ones, not the ones that enable the most secure configurations.

[Jason2866]

Arduino core 2.0.14 is based on IDF 4.4. IDF 4.4 does not have the possibility to disable WPA2 ciphers and only enable WPA3. btw. by doing this all users only having WPA2 would have a broken device.
For core 2.0.14 ciphers are disabled which are unused or broken. Sadly the used ones for WPA3 can't be enabled only. As said Arduino Core 3.0.0 based on IDF 5.1 has more granular control possibilitys of enabling ciphers.
If you can't or want to wait using WPA3 use a older Tasmota version or compile actual Tasmota with Arduino Core 3.0.0 alpha

[schildbach]

It's sad to hear. I hope it can be re-enabled at least for ESP32.

[Jason2866]

There will be no different setups. Checked already the configs. For core 2.0.14 it will not re-enabled since IDF 4.4 does not support such fine granular control.
Since Tasmota will move to core 3.0.0 when it is released, there is a chance since IDF 5.1 has more granular settings.

[Jason2866]

Tasmota compiled with core 3.0.0 should connect to WPA3 APS, since ESP_WIFI_ENABLE_WPA3_SAE is set.

        Select this option to allow the device to establish a WPA3-Personal connection with eligible AP's.
        PMF (Protected Management Frames) is a prerequisite feature for a WPA3 connection, it needs to be
        explicitly configured before attempting connection. Please refer to the Wi-Fi Driver API Guide for details.

[schildbach]

I'm now on Tasmota 14 with Core version 3.0.0:

Program Version	14.0.0 (release-tasmota32)
Build Date & Time	2024-05-14T13:54:09
Core/SDK Version	3_0_0/5.1.3.240430

But the Wifi connection is still WPA2. Is there anything I need to enable to get WPA3? I didn't see anything about it in the release notes.

[schildbach]

It's not possible with most home routers, e.g. FritzBox (largest brand in Germany). There is only WPA2/3 auto for the moment.

Note that Tasmota 12.x worked fine with the same router, I see that every time I cycle through the safe mode.

[schildbach]

Also, "WPA3 only" would exclude all the ESP8266 from the same network, assuming they won't get WPA3 with Tasmota 14?

Is there a way to tell Tasmota to prefer (or force) WPA3?

[Jason2866]

No, it is done "under the hood" from the closed source wifi stack. Can not be set granular. If both is enabled (WPA2/3) the wifi stack decides how to connect.
You can send out another SSID from your AP which has only WPA3 enabled.
I know the Fritz Box Routers. Highly overpriced with reduced crippled features.
Have you checked if PMF is set for WPA3 in the Fritz Box?

[schildbach]

PMF seems to be enabled as a "Signal property", but the encryption is still WPA2.

[schildbach]

[Jason2866]

Regarding https://docs.espressif.com/projects/esp-idf/en/release-v5.1/esp32/api-guides/wifi-security.html#setting-up-wpa3-personal-with-esp32 WPA3 is used by default when the requirements are met.
The mentioned configs are all set, when the Tasmota Arduino Libs are compiled with IDF 5.1

[schildbach]

The document states:

WPA3-Personal is now the highest supported protocol in terms of security, so it will be automatically selected for the connection whenever available. For example, if an AP is configured to be in WPA3 Transition Mode, where it will advertise as both WPA2 and WPA3 capable, Station will choose WPA3 for the connection with above settings.

I think this "WPA3 Transition Mode" is exactly the "WPA2/3" setting that home routers offer at the moment. But WPA3 isn't automatically selected as stated above.

[Jason2866]

As already said before, everything is set for WPA3. If it does not work we can do nothing.

[schildbach]

I'm just wondering why did it work without problem with version 12.x? You said you removed ciphers for version 13 – maybe that has caused the regression?

[Jason2866]

No. The ciphers are there. espressif does changes and fixes in the closed source wifi libs. Since the mentioned version the libs have changed a lot. There is no description what has changed. The wifi libs needs needs to fit to the used IDF version. There is no choice possible which libs to use.
The only choice you have is using the older Tasmota version which works for you with WPA3.
Have you removed TKIP? Only AES is allowed for WPA3. The insecure TKIP protocol should be removed in general (for WPA2 too).

[l-jonas]

Version 13.0.0 works fine for me with WPA3. Issues start at newer versions.

[Jason2866]

WPA3 support is removed in later framework builds. Reason support for WPA 3 takes a lot of flash space.
If needed support can be added with Hybrid Compile.
Example env

[env:tasmota32-WPA3_SAE]
; Arduino libs with WiFi Enterprise support
extends                     = env:tasmota32_base
build_flags                 = ${env:tasmota32_base.build_flags}
                              -DFIRMWARE_TASMOTA32
                              -DOTA_URL='""'
lib_ignore                  = Micro-RTSP
custom_sdkconfig            = CONFIG_ESP_WIFI_ENTERPRISE_SUPPORT=y
                              CONFIG_ESP_WIFI_ENABLE_WPA3_SAE=y
                              CONFIG_ESP_WIFI_ENABLE_WPA3_OWE_STA=y

[Jason2866]

@schildbach Tasmota is Open Source :-)! As described above with Hybrid Compile you can simply add the needed sdkconfig settings to support WPA3. There are no changes needed in Tasmota. WPA support is done in the IDF / Arduino (precompiled) libs.
A runtime option makes no sense, if WPA3 support is added there is a lot of flash space already lost.
That is the reason why it is removed. One of the design goals of Tasmota is to provide as much as possible functions without having many different builds. So there will be no official Tasmota WPA3 version.

[sfromis]

Removing features making Tasmota easy to use for a wide swath of users may not be that helpful just to cater to a tiny minority wanting more than perimeter security in their networks. There's really not that much in features which would be good candidates for trimming, as most of the included drivers (in the standard precompiled build) are for lights and energy monitoring, both of which are used a lot.

[l-jonas]

"Removing features making Tasmota easy to use" and a "a security-first variant" can co-exist.

Looking at the proposed configuration, it looks like the WPA3 support could be smaller. Somehow, older versions with WPA3 were small enough.

[l-jonas]

"A runtime option makes no sense" can not apply to "force WPA3 during connecting". There are users that want to use WPA2 temporarily or permanently. Tasmota does not provide an option like this yet so that theoretically (did not try it) makes a downgrade attack easy.

[Jason2866]

If you found a way to enable WPA3 without using a lot of flash space, a PR is very welcome.
As I already wrote you can change settings and compile a version where a WPA3 connection is possible

[l-jonas]

In my experiments, WPA3 support took 53 KB (or 3 KB more when including the two options that I consider unnecessary). The suggested configuration had a Used Flash size : 2003810 bytes. According to this, the app0 partition has a size of 2,8 MB. I do not see a size issue.

My test safeboot image using the default configuration had a Used Flash size : 716348 bytes. The partition is 832 KB big. So another 53 KB would fit (assuming that the size difference caused by WPA3 is similar to the regular image).

[Jason2866]

That's why I made Hybrid Compile mode. Small changes users wants in sdkconfig.
Happy Christmas and enjoy your possible WPA3 connection.
Adding 53k to safeboot makes some MCU variants to go over the limit.