Wireshark decryption needs updates for AKM 24
Regarding WPA3 decyption, it appears that epan/crypt/dot11decrypt.c may not have kept up-to-date with some of the changes in the underlying IEEE spec.
Specifically, AKM 24 supports three different integrity algorithms: HMAC-SHA-256, -384, and -512. The resulting KCK size is 128, 192, or 256 bits accordingly. This is mostly dependent on whether group 19, 20, or 21 is chosen.
However, several functions in dot11decrypt.c make decisions solely based on AKM:
Dot11DecryptGetIntegrityAlgoFromAkm
Dot11DecryptGetKckLen
Dot11DecryptGetKekLen
Dot11DecryptGetHashAlgoFromAkm
For this reason, decryption of WPA3 encrypted traffic currently does not work in Wireshark if the AKM is 24.
Note that AKM 18 also supports different integrity algorithms and KCK length.
I tried modifying the functions above to add "case 24:" and hard-code 128-bit and HMAC-SHA-256, but the decryption still didn't work. Thought I would raise the issue here to see if anybody had any advice. Thanks!
Source: IEEE Std 802.11-2024, table 12-11.
