Companion-BSSID Assisted PSK Discovery: Enabling WPA3-SAE in Multi-PSK (ePSK / MPSK / DPSK / iPSK) Community-Wide Wi-Fi Deployments

Abstract

Multi-family residential communities, student housing, senior living and hospitality venues increasingly deploy a single community-wide SSID in which every resident is issued a unique pre-shared key (PSK) that is bound to a dedicated VLAN. Vendors market this capability under several names, including Enterprise PSK (ePSK), Multiple PSK (MPSK), Dynamic PSK (DPSK) and Identity PSK (iPSK), but all implementations rely on the same mechanism: the access point (AP) identifies the resident's key by performing a reverse lookup of the Message Integrity Code (MIC) contained in message 2 of the WPA2 four-way handshake against every PSK provisioned for the SSID. The Simultaneous Authentication of Equals (SAE) exchange mandated by WPA3-Personal is, by design, resistant to offline dictionary attacks, and therefore removes exactly the property on which MIC-based key identification depends. Furthermore, the 6 GHz band admits only WPA3-SAE, so multiPSK networks cannot be extended to Wi-Fi 6E/7 clients without a new identification mechanism. This paper proposes a Companion-BSSID Assisted PSK Discovery (CAPD) algorithm that combines (i) a broadcast WPA2-PSK-only companion BSSID used exclusively for first-time onboarding and PSK discovery, (ii) a hidden primary BSSID with the same SSID operating in WPA2/WPA3 transition mode, (iii) a per-station PSK binding cache, and (iv) IEEE 802.11v BSS Transition Management (BTM) to steer the onboarded client to the primary BSSID, where SAE is executed using the already-learned PSK. The approach requires no client software change, no SAE password identifier support and no modification to the SAE protocol. The design, algorithm, complexity and security properties are presented, and an experimental evaluation across a broad range of commercial client devices demonstrates seamless transition with per-resident VLAN isolation preserved.