WPA3 regression on ESP32 device with 13.3.0?

[schildbach]

I've got a Sonoff M5-3C (ESP32) and I'm pretty sure in some pre-13.3.0 Tasmota it connected to my Wi-Fi router via WPA3. Now, with version 13.3.0, it only connects via WPA2. Is this intentional? Should I open a bug report?

Program Version	13.3.0(tasmota32)
Build Date & Time	2023-12-12T14:31:42
Core/SDK Version	2_0_14/4.4.6.231122
ESP Chip Id	13217284 (ESP32-D0WD-V3 v3.0)
Flash Chip Id	0x16405E (DIO)

[Jason2866]

We have reduced the amount of mbedtls ciphers to reduce flash memory footprint.
This affects the cypher used for WPA3 too. We are checking how much of flash increase does it costs to re-enable the needed one(s) for WPA3. If it consumes to much flash, WPA3 will left disabled.
So, no it is not a bug.

[Kahless2001]

This isn't really ok. If we are going to disable ciphers to save space, we should be removing old broken ones, not the ones that enable the most secure configurations.

[Jason2866]

Arduino core 2.0.14 is based on IDF 4.4. IDF 4.4 does not have the possibility to disable WPA2 ciphers and only enable WPA3. btw. by doing this all users only having WPA2 would have a broken device.
For core 2.0.14 ciphers are disabled which are unused or broken. Sadly the used ones for WPA3 can't be enabled only. As said Arduino Core 3.0.0 based on IDF 5.1 has more granular control possibilitys of enabling ciphers.
If you can't or want to wait using WPA3 use a older Tasmota version or compile actual Tasmota with Arduino Core 3.0.0 alpha

[schildbach]

It's sad to hear. I hope it can be re-enabled at least for ESP32.

[Jason2866]

There will be no different setups. Checked already the configs. For core 2.0.14 it will not re-enabled since IDF 4.4 does not support such fine granular control.
Since Tasmota will move to core 3.0.0 when it is released, there is a chance since IDF 5.1 has more granular settings.

[Jason2866]

Tasmota compiled with core 3.0.0 should connect to WPA3 APS, since ESP_WIFI_ENABLE_WPA3_SAE is set.

        Select this option to allow the device to establish a WPA3-Personal connection with eligible AP's.
        PMF (Protected Management Frames) is a prerequisite feature for a WPA3 connection, it needs to be
        explicitly configured before attempting connection. Please refer to the Wi-Fi Driver API Guide for details.

[schildbach]

I'm now on Tasmota 14 with Core version 3.0.0:

Program Version	14.0.0 (release-tasmota32)
Build Date & Time	2024-05-14T13:54:09
Core/SDK Version	3_0_0/5.1.3.240430

But the Wifi connection is still WPA2. Is there anything I need to enable to get WPA3? I didn't see anything about it in the release notes.

[schildbach]

It's not possible with most home routers, e.g. FritzBox (largest brand in Germany). There is only WPA2/3 auto for the moment.

Note that Tasmota 12.x worked fine with the same router, I see that every time I cycle through the safe mode.

[schildbach]

Also, "WPA3 only" would exclude all the ESP8266 from the same network, assuming they won't get WPA3 with Tasmota 14?

Is there a way to tell Tasmota to prefer (or force) WPA3?

[Jason2866]

No, it is done "under the hood" from the closed source wifi stack. Can not be set granular. If both is enabled (WPA2/3) the wifi stack decides how to connect.
You can send out another SSID from your AP which has only WPA3 enabled.
I know the Fritz Box Routers. Highly overpriced with reduced crippled features.
Have you checked if PMF is set for WPA3 in the Fritz Box?

[schildbach]

PMF seems to be enabled as a "Signal property", but the encryption is still WPA2.

[schildbach]

[Jason2866]

Regarding https://docs.espressif.com/projects/esp-idf/en/release-v5.1/esp32/api-guides/wifi-security.html#setting-up-wpa3-personal-with-esp32 WPA3 is used by default when the requirements are met.
The mentioned configs are all set, when the Tasmota Arduino Libs are compiled with IDF 5.1

[schildbach]

The document states:

WPA3-Personal is now the highest supported protocol in terms of security, so it will be automatically selected for the connection whenever available. For example, if an AP is configured to be in WPA3 Transition Mode, where it will advertise as both WPA2 and WPA3 capable, Station will choose WPA3 for the connection with above settings.

I think this "WPA3 Transition Mode" is exactly the "WPA2/3" setting that home routers offer at the moment. But WPA3 isn't automatically selected as stated above.

[Jason2866]

As already said before, everything is set for WPA3. If it does not work we can do nothing.

[schildbach]

I'm just wondering why did it work without problem with version 12.x? You said you removed ciphers for version 13 – maybe that has caused the regression?

[Jason2866]

No. The ciphers are there. espressif does changes and fixes in the closed source wifi libs. Since the mentioned version the libs have changed a lot. There is no description what has changed. The wifi libs needs needs to fit to the used IDF version. There is no choice possible which libs to use.
The only choice you have is using the older Tasmota version which works for you with WPA3.
Have you removed TKIP? Only AES is allowed for WPA3. The insecure TKIP protocol should be removed in general (for WPA2 too).