1) Add support for MAC randomization in Active scan and connect
2) Add support for randomizaton of sequence numbers
3) Add support for randomization of dialog token for GAS frames
- Route NAN pairing bootstrap via NPBA receive path
- extend datapath_req wait time to fit secured M1-M4 handshake
- Plug ND-PMK derived from KDK into NDP
- prefers paired-peer cached ND-PMK (from PASN pairing complete), when available
- carry ND-PMK metadata in pairing install callback
- Extend PASN key-installed callback payload to include role, mapped NDP CSID
and derived ND-PMK so the NAN layer can populate paired-peer security cache.
Co-authored-by: Akshat Agrawal <akshat.agrawal@espressif.com>
Co-authored-by: Sarvesh Bodakhe <sarvesh.bodakhe@espressif.com>
- Create pasn module from upstream. Changes till 1a791e9c
- Add ecdh prime len api to MbedTLS port
- Integrate nan and pasn modules for PIN code method
- Fix KCK length and add auth timeout
- Add NAN Pairing PASN support
- Implement the bootstrapping handshake phase of NAN pairing (spec 7.6.4.1).
- Add pairing support to NAN Publish/Subscribe APIs:
- Add dummy NIRA , MME Attributes
Implement the NAN Data Path encrypted datapath per Wi-Fi Aware v4.0
(§7.1.3.5, §9.5.16):
- Responder + initiator sides of the M1-M4 Shared-Key Descriptor
exchange, with MIC compute/verify, PTK derivation, and PMK/PMKID
derivation via PBKDF2-SHA256 over passphrase or pre-shared PMK.
- CSIA / SCIA attribute build + parse, NCS-SK-128 cipher suite.
- Per-NDL security context on ndl_info::security_ctx; per-svc PMK cache.
- ndp_response_indication callback for initiator peer-NDI binding.
- host<->blob ABI migrated from 27 direct esp_nan_* externs to a single
nan_secure_dp_funcs callback struct in esp_private/wifi.h.
- nan_security.c split out of nan_app.c (~340 lines de-duplicated into
shared M1-M4 helpers).
- CONFIG_ESP_WIFI_NAN_ENCRYPTED_DATAPATH gates the secure path so non-
security builds compile out the crypto/handshake code.
- ROM patch (esp32s31): mask ieee80211_encap_esfbuf to match the
c5/c6/c61 pattern for NAN-capable chips.
Hardening: PMK stack copies zeroized on every return, NDP attribute
parsers bounds-checked, CSID range-checked before shifting, NDL slot
reuse only when handshake state is IDLE, get_csia/scia_len aligned with
their builders on empty input.
API surface: NDP security types moved out of esp_wifi_types_generic.h
into esp_private/wifi.h (internal-only). security pointer dropped from
struct ndp_cb_peer_info. Discovery-side wifi_nan_security_type_t and
the NDP Info callbacks removed (subsumed by csid_bitmap and SSI
respectively).
- OWE: clear PRK on HKDF failure; wipe PMK with bin_clear_free; reuse PMK
buffer when size matches.
- 4-way handshake: drop extra OWE check so WPA2-PSK can try the next passphrase.
- SoftAP: simpler OWE key setup and assoc response IEs (skip useless RSNXE step).
Initial step of migration of esp-wifi-remote to IDF
This cannot be an official component, as it would colide with the
existing managed esp_wifi_remote.
This needs to be an additional functionality of esp_wifi (subdirectory)
used in these 3 scenarios:
* Adding remote functionality esp_wifi() APIs to chips without WiFi
(esp32p4, h2,...)
* Additional WiFi interface for chips which already have WiFi
* Genuine WiFi interface for linux target host applications
The ownership of WiFi's remote functionality will be transfered back
to the wifi team after the migration and stabilization.
1. fix(wifi): Rename old NAN configuration to NAN-Sync
- Rename CONFIG_ESP_WIFI_NAN_ENABLE to CONFIG_ESP_WIFI_NAN_SYNC_ENABLE to indicate
the support for Synchronized NAN (Wi-Fi Aware).
- Because the original flag really controls the synchronized feature set, rename it
to CONFIG_ESP_WIFI_NAN_SYNC_ENABLE so the NAN-Sync and NAN-USD paths can be
selected independently without confusion.
2. Document esp_wifi_start requirement and fix USD examples
3. Rename nan_callbacks to nan_sync_callbacks
4. Remove the discovery_flag, clarify docs for sync vs USD flows, and add USD start/stop APIs
5. Require esp_wifi_start() before USD start
6. docs(nan): add NAN-USD application examples
7. add migration guide and hints for NAN-USD proto field
8. Improve allow_broadcast documentation
9. Add attention to the API esp_wifi_remain_on_channel
10. fix(wifi): align NAN API renames and docs for v6.0
- keep shared APIs under esp_wifi_nan_* while reserving
sync/usd names for mode-specific entry points
- clarify synchronized-cluster scope in headers, docs, and migration notes (EN/zh-CN)
- update examples for renamed helpers and WIFI_NAN_SYNC_CONFIG_DEFAULT()
- rename `wifi_nan_config_t` to `wifi_nan_sync_config_t`
11. Mark NAN-USD as esp-idf experimental feature
1. Remove redundant fixes in upstream wpa_supplicant for USD
- Upstream supplicant has mostly fixed the issues regarding the
unnecessary resetting pauseStateTimeout.
- Upstream supplicant still needs one fix to avoid resetting the
pauseStateTimeout when subscribe message is received from the peer
which had triggered the pauseStateTimeout previously.
2. Replace array-based channel list with bitmap for NaN-USD
Use `wifi_scan_channel_bitmap_t` to represent the channel list for NaN-USD
publisher and subscriber configurations. This replaces the previous approach
that used a large array to store allowed channels.
Also aligns with internal scan bitmap conventions across Wi-Fi stack.
3. call esp_wifi_nan_stop() after USD exchange or STA stop
Ensure esp_wifi_nan_stop() is called after publish/subscribe activity
completes or when WIFI_EVENT_STA_STOP is received. This prevents NAN stop
errors due to inactive interface. NaN-USD currently uses STA interface
for Tx/Rx.
4. Fix task watchdog timer triggered in active USD subscriber:
As both USD supplicant and offchan TX component gets executed
in the wifi task, it created a deadlock like scenario where offchan TX
done callback was never getting executed and supplicant 'nan_de_timer'
keeps running but failing to send any subscribe frame.
5. Make sure that device is able to recieve action management frames
of size more than 1400 bytes.
6. Update proto field in SSI to match Wi-Fi Aware (NaN) spec format
The 'proto' field in the 'wifi_nan_wfa_ssi_t' structure previously used an
enum (wifi_nan_svc_proto_t), resulting in a 32-bit field. According to
the Wi-Fi NAN Specification (Table 5.7), this field must be a single
octet (8 bits). This commit updates the type to uint8_t to ensure
compliance with the specification.
This mismatch previously triggered warnings but did not cause functional
errors.
7. Set `allow_broadcast` to true in USD Remain on channel
This enables the peer discovery as USD uses NAN-Network Multicast BSSID
as A3 address in publish frames.
8. Implement custom channel<->frequency conversion for NAN-USD
NaN-USD only permits 20 MHz bandwidth channels in the 2.4 GHz and 5 GHz bands
(as per section 4.5.3 of the Wi-Fi Aware Specification v4.0). To avoid linking
a large portion of upstream supplicant code for frequency-to-channel and
channel-to-frequency conversion, implement minimal custom helper functions.
9. Limit NAN_DE_MAX_SERVICE to 2 for ESP_SUPPLICANT
10. Note: Upstream clamps negative `os_reltime` deltas to zero in `nan_de_srv_time_to_next()`,
but our ESP_SUPPLICANT port keeps `os_time_t` unsigned, so that guard just provokes a
compiler warning. We skip it for now because the scheduling loop validates past timestamps
before computing the diff.
Co-authored-by: Shyamal Khachane <shyamal.khachane@espressif.com>
- Fix issues in Max Idle period negotiation and protected keep alive
- Add BSS Max Idle config in SoftAP config and create a feature flag
- Add a unit test case to test both STA and SoftAP implementation
- Avoid downgrading TLS ciphersuites when client RSA keys are larger than RSA-2048 bit.
- Note that when using bigger certificates on low-power chips without crypto
hardware acceleration, it is recommended to adjust the task watchdog timer (TWDT)
if it is enabled. For precise information on timing requirements, you can check
performance numbers at https://github.com/espressif/mbedtls/wiki/Performance-Numbers.
Shreyas Sheth
Aditi
Jiang Jiang Jian
Kapil Gupta
tarun.kumar
liuning
muhaidong
David Cermak
sibeibei
Sajia
wangtao@espressif.com
Li Shuai
yinqingzhao
xuxiao
jgujarathi
xiehang