Not an OpenWrt question necessarily, but this felt like a good community to ask. With WPA3-SAE, is a longer key (assuming it was a strong one) more secure than a shorter one?
I ran into an issue with a device that limits key length, and it had me wondering. From what I've read, it seems like a reasonably long, secure key should be equally secure--outside of some prior brute force vulnerabilities like Dragonblood--but the deeper protocol documents I've found are over my head.
The maximum key length is 64 characters, but SAE uses a hash of it.
This is what OpenWrt supports.
Any device firmware that limits key length to less than this maximum should be avoided, not least because it implies sloppy coding.
Yes, I guess brute force might potentially be easier with a shorter key, but being realistic it probably makes little difference in practice without some insider information.
Usability is just as important, if the old adage "your password is so complicated and non-memorable, you have to write it on a post-it note stuck to your screen" applies, you also have a problem.
I thought sae allowed up to 128?
sae-mixed or any of the lower ones 64.
To be exact, the IEEE Std 802.11-202 standard does not define a maximum SAE key length.
For compatibility it is recommended to limit to 64 and this is what it seems is enforced in OpenWrt.
I found this by trial and error. Longer lengths are truncated.
For autonomous systems (eg 802.11s mesh implementations), the recommendation is to use the sha256sum hash of some pre-shared string, thus giving a convenient 64 octet string for key use.
(Hash length: Always 64 characters, 256 bits encoded in lowercase hex.)
The original question, does brute force difficulty vary by key length?
Obviously not if the key is hashed because the SAE_PASSWORD length is fixed at 64...