In a controller-based city WLAN using 802.11r, what conceptual roles do FT key holders play?
Select an answer to reveal the explanation.
Short Explanation
R0KH and R1KH are the trusted key cashiers in the FT hierarchy—holding and handing the right key material so roamers stay secure and fast. They are not portal-cookie jars or open-VLAN switches. Pairwise keys still matter; these roles help derive and move FT state.
Full Explanation
In controller-based municipal WLANs implementing 802.11r fast roaming, the roles of the Fast Transition (FT) key holders—specifically the R0 Key Holder (R0KH) and R1 Key Holder (R1KH)—are fundamental to enabling rapid and secure BSS transitions. The R0KH typically resides in the controller or authentication server and manages the root key hierarchy, while the R1KH is often located on the AP or controller and handles distribution of transient keys to clients. Together, they facilitate the derivation and secure distribution of Pairwise Transient Keys (PTKs) during roaming, allowing clients to authenticate quickly to new APs without full reauthentication. This mechanism reduces latency and maintains encryption continuity. The misconception that these key holders replace all pairwise transient keys is incorrect; instead, they manage and distribute these keys within the FT framework. They do not store guest portal cookies, which are unrelated to FT key management, nor do they force traffic onto open VLANs during roaming, which would compromise security. It is crucial to understand that FT key holders operate within the scope of 802.11r and require compatible client support to function effectively. Operationally, administrators can verify FT key holder activity by examining controller logs for FT authentication exchanges and confirming that roaming clients maintain encrypted sessions without reauthentication delays.