During a design review, staff ask how OKC speeds secure reassociation across city APs. What is the core idea?
Select an answer to reveal the explanation.
Short Explanation
OKC keeps a spare set of keys in the campus’s pocket so the next AP can greet a known client without a full EAP redo. That is opportunistic caching, not an open-SSID trick. Killing keys every half minute is the opposite idea.
Full Explanation
Opportunistic Key Caching (OKC) speeds secure reassociation across city APs by caching the Pairwise Master Key Security Association (PMKSA) state after a successful full authentication. When a client roams to a new AP within the same mobility domain, the AP can reuse the cached key material to perform a fast, secure reassociation without repeating the entire Extensible Authentication Protocol (EAP) exchange. This mechanism reduces latency and overhead during roaming, improving user experience and network efficiency. Incorrect ideas include that OKC deletes all pairwise keys every thirty seconds, which is false because key caching is meant to persist for a reasonable duration to facilitate roaming. Another misconception is that OKC converts Enterprise SSIDs into open SSIDs mid-roam, which would eliminate security; OKC maintains encryption and authentication integrity. The notion that OKC only works if Certificate Revocation List (CRL) checking is disabled is inaccurate; CRL checking is independent of OKC’s function. The operational caveat is that OKC requires APs to be configured within the same mobility domain and support key caching; otherwise, clients fall back to full authentication. To confirm understanding, consider a client moving between city APs with OKC enabled: will it need to perform a full EAP exchange each time? No, it will reuse cached keys, demonstrating the mechanism’s efficiency.