Re: [PATCH 1/2] wifi: iwlwifi: enable MFP_CAPABLE in FIPS mode

[Jose Ignacio Tornos Martinez]

Hi Johannes,

Thank you for the quick response. 

Since we have some customers requesting this, I'd appreciate some
clarification on what specifically cannot be done so I can better
understand the firmware requirements.

Our testing shows MFP working with software crypto in FIPS mode
(connection succeeds, "MFP: yes" confirmed, firmware reports SEC_ENC_ERR
0x707 indicating it's not handling the frames). Indeed it was working like
this before your commit.
But clearly I'm missing  something important about the architecture.

Could you help me to understand:
- What breaks when MFP_CAPABLE is enabled in FIPS mode?
- Is there a specific scenario (beyond WoWLAN/beacon protection) where
  firmware must handle MFP frames?
- Is the issue that it appears to work but fails in certain conditions?

If possible, I would like to get information at least to justify the
reasons why FIPS cannot be used with WiFi Intel cards (or if there is
some way/approach to make it work).

Thanks

Best regards
Jose Ignacio