
The 802.11 Workgroups’ Solutions for Fast Secure Roaming
NAS Client
SME
R0 KH
PMK-R0 = KDF (MSK…)
PMK-R1 = KDF (PMK-R0…)
(Key Lifetimes)
MSK
R1 KH-3
R1 KH-2
R1 KH-1
GTK-3
GTK-2
GTK-1
Encrypt and Validate
KDE/GTK (KEK)
MIC Generation and Validation
(KCK11)
Replay Counters
802.1X Authenticator-3
802.1X Authenticator-2
802.1X Authenticator-1
(Port Control, GTK, TKIP
Countermeasures,
Initial 11r Association)
802.11 MAC-3 1
802.11 MAC-2
802.11 MAC-1
PTK
Figure 9.5: The 802.11r Keys, Their Holders, and the Relationships among Them. (Courtesy of
the IEEE.)
Figure 9.6 shows that from the top-of-hierarchy, another level of the PMK is created. In the
802.11r standard, this key is