802.11 · WiFi

PMF / 802.11w the deauth attack and its cure

A single frame that carries no signature can throw a device off a Wi-Fi network — no password, no membership, no broken cipher. This plate shows why that frame was designed that way, exactly what Protected Management Frames seals and what it deliberately leaves in the open, and why 'my network is Wi-Fi 6, so it has this' is not the same statement as 'this SSID negotiates PMF'.

Sequence diagram poster of the WPA2 4-way handshake

Requesting scene from the content service…

frame families PMF protects — and no more

1000 TU

SA Query timeout, from IEEE's own MIB

off

the factory default on 2.4 and 5 GHz

a forged deauth needs no keyBIP and the IGTK: a seal, not encryptionSA Query: prove you are still youbeacon and probe stay unprotected

What you'll learn

Why management frames travel unprotected: the authenticate → associate → keys order leaves a window that no amendment can close.
Which frames are robust management frames — and that beacon, probe, authentication and association are not among them.
The two cryptographic paths: CCMP with the existing PTK for unicast, and BIP with the IGTK for group frames — a seal, not encryption.
How the SA Query procedure defends the access point from a spoofed association, with the timers the IEEE MIB actually defines.
The three modes as two bits of RSN Capabilities (MFPC and MFPR), why WPA3 cannot exist without PMF, and why a certified Wi-Fi 6 device still ships with PMF off on 2.4 and 5 GHz.

A frame nobody could ever check

The original 802.11 design is a sequence of states: a station authenticates, then associates, and only then do keys exist. Everything that happens before that has to travel in the clear, because there is nothing yet to protect it with — and everything that advertises the network has to be readable by strangers, since a stranger is precisely who is trying to join. A deauthentication frame lives in that world: it is a notification rather than a request, it carries no integrity check, and the only identifiers it needs are visible in every frame on the channel.

The consequence is not a defect in any product. Anyone within radio range, with a card that can inject, can produce a frame that says the connection is over. And the disconnection is often a means rather than an end: Wi-Fi Alliance documents that forced reconnections are used to speed up offline dictionary attacks against the passphrase, and to steer clients toward an access point under someone else's control.

What 802.11w seals, and what it does not

Protected Management Frames applies to a defined set — robust management frames: disassociation, deauthentication and robust Action frames. Unicast ones are protected with CCMP under the PTK that already existed, which adds confidentiality, replay protection and data origin authenticity at no extra cost in keys or handshakes. Group ones are protected with BIP using a new key, the IGTK, delivered inside the key handshake: AES-128 in CMAC mode adds a MIC and replay protection, but it seals rather than encrypts — the announcement stays readable, it just cannot be forged.

Half of the mechanism protects the access point rather than the client. Against a spoofed association request from an already-associated station, the AP no longer tears down the live session: it rejects temporarily with status code 30 and a comeback time, leaves the existing association untouched, and asks the real client an SA Query that only a holder of the live session key can answer. The impostor can ask; it cannot reply.

The sentence worth remembering

"Wi-Fi 6 requires PMF" and "this Wi-Fi 6 network has PMF" are different statements, and only the first is true. Certification binds the device: every Wi-Fi CERTIFIED 6 device supports Protected Management Frames, and every WPA3 association negotiates them by definition. It does not bind the BSS — the same certified access point can run a WPA2 SSID on 2.4 or 5 GHz with the feature switched off, which is the factory default in the reference implementation and in the vendor platforms alike. It becomes unconditional only where the old security is barred outright: 6 GHz and Sub 1 GHz.

The plate is deliberately defensive: it explains the mechanism of the attack and the mechanism of the cure, with no reproducible procedure and no tooling. It also states its own limits on screen — the key ceremony is drawn as a black box, rekeying is not modelled, there is a single access point and no roaming, the attacker stands outside the network, and beacons are shown unprotected because covering them needs Beacon Protection, a separate mechanism that ships disabled.

← Previous plate

WPA3-Enterprise 192-bit · CNSA suite

Next plate →

Evil twin and rogue AP · the network that lies

Atlas index