On Fri, Mar 02, 2018 at 03:10:56PM -0500, msiedzik@xxxxxxxxxxxxxxxxxxx wrote: > Delay Protect and Replay Protect are two separate and distinct features > of MKA. Per IEEE802.1X-2010 Clause 9.10.1 "Delay Protect, TRUE if LPNs > are being reported sufficiently frequently to allow the receipt to > provide data delay protection. If FALSE, the LPN can be reported as > zero", and per Clause 9.10 "NOTE - Enforcement of bounded received delay > necessitates transmission of MKPDUs at frequency (0.5 s) intervals, to > meet a maximum data delay of 2 s while minimizing connectivity > interruption due to the possibility of lost or delayed MKPDUs." > > This means ieee802_1x_mka_sak_use_body.delay_protect should only be set > TRUE when MKPDUs are being transmitted every 0.5 s (or faster). By > default the KaY sends MKPDUs every MKA_HELLO_TIME (2.0s), so by default > delay_protect should be FALSE. > > A new 'u32 mka_hello_time' parameter to has been added to the > 'ieee802_1x_kay' data structure. If delay protection is desired, the > KaY initialization code should set kay->mka_hello_time to > MKA_BOUNDED_HELLO_TIME (500ms). Thanks, applied. -- Jouni Malinen PGP id EFC895FA _______________________________________________ Hostap mailing list Hostap@xxxxxxxxxxxxxxxxxxx http://lists.infradead.org/mailman/listinfo/hostap
