RSN Information Element

The single 802.11 IE that says everything about a network’s security: cipher suites, authentication keys, MFP capability and requirement, PMKSA caching, FT support. The RSN IE is the parameter-negotiation surface attackers manipulate.

Status: drafting Related: Beacon frames, Authentication and association, WPA versions, Handshakes

Where the RSN IE appears

The same RSN IE (tag 48) is carried in:

• Beacon — what the AP advertises.
• Probe Response — same.
• Association Request / Reassociation Request — what the STA wants to use.
• EAPOL-Key Message 2 of 4 (4-way handshake) — STA’s RSN IE binding.
• EAPOL-Key Message 3 of 4 — AP’s RSN IE binding.

The 4-way handshake binds the STA-side and AP-side RSN IEs into the MIC. Mismatch = PTK install failure.

Layout

Tag (48) | Length | Version (2) | Group Cipher Suite (4)
| Pairwise Cipher Suite Count (2) | Pairwise Cipher Suites (4 × N)
| AKM Suite Count (2) | AKM Suites (4 × N)
| RSN Capabilities (2)
| PMKID Count (2) | PMKIDs (16 × N)        [optional]
| Group Management Cipher Suite (4)        [optional, with MFP]

Each cipher / AKM suite is a 4-byte tuple: 3-byte OUI + 1-byte type.

Cipher suites

Group and Pairwise:

The default WPA2 cipher is CCMP-128. WPA3 mandates GCMP-256 for the WPA3-Enterprise 192-bit profile. Mixed cipher modes were a downgrade source pre-WPA2-2020.

AKM suites — Authentication Key Management

Multiple AKMs in one IE means the AP supports several modes; the STA picks one in its Association Request. WPA3 transition mode (PSK + SAE) is the common case where downgrade attacks live.

RSN Capabilities

Two-byte bitmap. Notable bits:

A network is MFP-required iff MFPR=1, MFPC=1. WPA3-Personal mandates MFPR=1.

RSN IE downgrade

Pre-2020 vulnerability: an attacker rewriting the RSN IE in transit could force a STA / AP into a weaker negotiated state. The Vanhoef + Piessens KRACK work showed the 4-way handshake replays could partially circumvent the IE binding under certain implementations.

Modern fix: every transmission of the RSN IE is structurally compared and binds into MIC. Mismatch aborts the handshake.

PMKID

The optional PMKID list at the end of the RSN IE in Association Request enables PMKSA caching: “I have a cached PMK for these IDs; skip to PTK derivation.” The AP looks up the PMKID; on hit, no full EAP exchange is needed.

Offensive note. Steube (hashcat) showed in 2018 that the AP’s M1 of the 4-way handshake includes the PMKID — so for WPA2-PSK an attacker can capture M1 without ever capturing a full handshake and brute-force the PSK offline. Most APs disable this leak now (disable_pmksa_caching=1 in hostapd, or PMKID=0 in M1 if not advertised). See hashcat -m 22000.

Group Management Cipher Suite

Last optional 4-byte tuple. Specifies the cipher used for IGTK protection (BIP-CMAC-128 by default; BIP-GMAC for higher security).

Tooling

• tshark -V decodes RSN IE in beacons / probes / association.
• hostapd.conf’s wpa=, wpa_pairwise=, wpa_key_mgmt=, ieee80211w= map directly to RSN IE fields.
• wpa_supplicant’s ieee80211w=, key_mgmt= likewise.
• hcxdumptool -m wlan0mon -o capture.pcapng captures everything needed for hcxpcapngtool → hashcat -m 22000.

See also

• WPA versions — how AKMs map to user-facing modes.
• Authentication and association — where the IE travels.
• MFP — MFPR/MFPC bits.
• Handshakes — IE binding into the 4-way MIC.

References

• IEEE 802.11-2020 §9.4.2.24 (RSN element).
• Steube — PMKID-based WPA/WPA2 attack — https://hashcat.net/forum/thread-7717.html