A candidate claims Fast BSS Transition simply turns off encryption during roam. What is the correct CWSP-level understanding?
Select an answer to reveal the explanation.
Short Explanation
FT is a fast lane with the same seatbelt, not an unlock-everything detour. It reuses key state so phones do not redo full 802.1X at every AP while traffic stays protected. Open mid-roam hops are not the feature.
Full Explanation
Fast BSS Transition (FT), standardized as IEEE 802.11r, is designed to optimize the roaming process in municipal and civic WLAN deployments by significantly reducing the time required for a client to move between access points (APs). A common misconception is that FT simply disables encryption during the roam to speed up transitions; however, this is incorrect. FT achieves faster roaming by reusing the existing key hierarchy established during the initial full authentication, typically via 802.1X and RADIUS, thereby avoiding the need to perform a complete authentication exchange every time a client associates with a new AP. This reuse of cryptographic material ensures that encryption remains intact and security is preserved throughout the roaming process. The client and the new AP derive session keys from a previously established Pairwise Master Key (PMK), which maintains confidentiality and integrity of data without the overhead of full re-authentication. The incorrect notion that FT replaces AES with RC4 for voice clients misunderstands the protocol’s operation; FT does not alter the encryption algorithms in use. Instead, it optimizes key management, allowing the continued use of strong encryption standards such as AES-CCMP. Similarly, the idea that FT requires an open SSID between APs is false because FT operates within secure WLAN environments where all APs share the same security configuration and key management infrastructure. FT’s operation is also independent of RADIUS accounting settings; disabling accounting does not impact FT’s ability to accelerate roaming. It is important to note that both the client device and the WLAN infrastructure must support 802.11r for FT to function correctly. From an operational perspective, a practical way to verify FT’s correct implementation in a civic WLAN is to observe that roaming clients maintain encrypted sessions without triggering full 802.1X re-authentication upon each AP handoff, resulting in seamless and secure mobility.