Fast BSS Transition and the Key Hierarchy That Makes Roaming Quick

A station moving between access points in the same network must, in the base standard, run the whole join procedure again: an open authentication exchange, a reassociation request and response, then the four-message handshake that derives fresh pairwise keys from the pre-shared secret or from the authentication server. The cryptographic part is the slow part, and it involves a round trip to the server in enterprise deployments. For a bulk transfer the interruption is invisible. For a voice call, whose packets arrive every 20 milliseconds, an interruption lasting many packet intervals is an audible gap that concealment cannot cover.

Fast BSS transition exists to remove the cryptographic work from the handoff. It does so by precomputing keys along a hierarchy before the station moves, so that at the moment of the move only a short confirmation exchange is needed.

The key hierarchy

The base standard derives one pairwise master key per station from the network’s credential, and derives the pairwise transient key from it during each association, mixing in nonces from both sides. The transient key is fresh per association, which is the point: a compromise of one session’s keys does not compromise the next.

Fast transition keeps that freshness but moves the derivation earlier. It defines two intermediate keys.

The first is the PMK-R0, derived once per station per mobility domain. Its inputs are the pairwise master key, the network name, the mobility domain identifier, and identifiers for the station and for the key holder that generated it. The mobility domain is a 2-byte identifier advertised in the mobility domain element that access points include in their beacons; it tells a station which access points share a key hierarchy. Two APs with the same mobility domain identifier can perform a fast transition between them, and two with different identifiers cannot, even if they belong to the same network.

The second is the PMK-R1, derived per station per target access point from the PMK-R0. Its inputs are the PMK-R0, the target AP’s basic service set identifier, and the identifier of the key holder that holds the R1 key. An AP in the mobility domain can compute the R1 key for any of its neighbours from the R0 key it already holds, which is why the hierarchy is two levels rather than one: the R0 key is the expensive thing to distribute, and it is distributed once.

The transient key is then derived during the transition from the PMK-R1 and the two nonces exchanged in the fast transition frames. The derivation is a key derivation function over a concatenation of labelled inputs, the same construction the base standard uses for its own key derivations, with labels that distinguish the R0, R1, and transient products. Because the labels differ, a key derived for one purpose cannot be substituted for another even though the underlying secret is the same.

The frames that carry the transition

The transition replaces the four-message handshake with an authentication frame exchange and a reassociation that carries the key material.

The station sends an authentication frame using the fast transition algorithm, carrying a fast transition element. The element holds the station’s nonce, the identifier of the key holder that will serve as the target’s R1 holder, and a message integrity check over the element computed with a key derived from the PMK-R1. The AP responds with its own authentication frame, its own nonce, and a check computed over both. At the end of these two frames each side has the material for the transient key, and each has proved it holds the R1 key without transmitting it.

The station then sends a reassociation request. Its robust security network element includes the fast transition element and the mobility domain element, and its message integrity check covers the request. The AP’s response confirms the association and includes a check of its own. The station is associated, the transient key is installed, and no four-message handshake occurred.

Two messages instead of four, and the expensive derivation of the R0 key happened when the station first joined the mobility domain rather than at the moment of the move.

Over the air or over the distribution system

The exchange can happen in two ways, and the choice is a trade between airtime and distribution-system latency.

In the over-the-air form, the station talks directly to the target AP. The station must be able to hear the target, which it usually can because it is moving toward it, and the exchange occupies the channel twice — once for the station’s frames, once for the target’s. It is the default because it requires no coordination between APs beyond the shared R0 key.

In the over-the-distribution-system form, the station sends its authentication request to its current AP, which forwards it to the target over the wired network, and the target’s response comes back the same way. The advantage is that the station does not need a working radio path to the target before the transition, which matters when the target is on a different channel. The disadvantage is that the exchange now depends on the wired path’s latency and on the current AP being willing to relay, and the frames are addressed through the distribution system rather than to the target’s basic service set identifier.

A station chooses the form by setting a field in its fast transition request, and an AP that does not support the chosen form must reject the request and let the station fall back to a full reassociation. The fallback is not graceful: the station discovers the rejection after it has already left the old channel in the over-the-air case, so a misconfiguration produces exactly the interruption the mechanism was meant to avoid.

Deciding to move

Fast transition makes the move cheap. It does not decide when to make it, and in the standard architecture that decision belongs to the station.

A station typically roams when the received signal from its current AP falls below a threshold and a candidate is meaningfully better, with hysteresis to prevent oscillation between two APs of similar strength. The thresholds are vendor policy and are not in the standard. The consequence is that a network operator cannot directly command a station to move, and stations with poorly tuned thresholds stay associated to a distant AP long after a better one is available, which is the same airtime problem described in Airtime fairness and the slow-client problem.

Two amendments give the network influence without taking the decision away. The radio resource measurement amendment defines a neighbour report: a station can ask its AP for a list of neighbouring basic service sets with their channels and reported signal strength, so that scanning a whole band is not necessary before a move. The network management amendment defines a basic service set transition management request, a frame in which an AP suggests that a station move to a listed candidate, optionally with a disassociation deadline. A station that supports the request may comply; a station that does not ignores it.

Neither mechanism makes the handoff deterministic, and both depend on the station implementing them. That is why voice deployments often rely on a controller that tracks associations and on client devices whose roaming behaviour has been qualified, rather than on any protocol guarantee.

What the transition does not fix

The key exchange is one of three delays in a handoff, and it is the only one fast transition removes.

The first remaining delay is discovery. A station must know the target’s channel, identifier, and capabilities before it can send anything. A full scan of the 2.4 GHz band takes over a hundred milliseconds if every channel is dwelled on; the neighbour report shortens it but does not eliminate it. Pre-association caching of scan results is what most client stacks do.

The second is the data path. Even with keys installed immediately, the frames in flight during the transition are lost, including the aggregate and block acknowledgement state that A-MPDU aggregation and block acknowledgement maintains between a station and its AP. A station that has sent a frame and not received its acknowledgement cannot know whether the frame arrived, and the target AP’s forwarding state for the station’s address is created at reassociation. The 802.11 standard does not define a mechanism to forward in-flight frames across the handoff, so a transport protocol above must recover them; that recovery is the business of the end-to-end protocol rather than of the link layer.

The third is the distribution system’s own state. A bridge that has learned the station’s address on the old AP’s port will keep sending frames there until it learns otherwise. The new AP sends a gratuitous frame or the distribution system is configured with a mechanism to update the forwarding entry. Without it, downlink traffic continues to arrive at the AP the station has left, and is dropped.

The aggregate effect is that cryptography stops dominating the interruption: what remains is discovery and the distribution system’s update, neither of which the transition frames shorten. The cryptographic part is what the hierarchy removed, and the reason it could be removed is that the expensive secret was derived once and the per-move derivation was reduced to a function of two public identifiers and one fresh nonce.

Where the hierarchy leaks

The hierarchy’s security rests on the R0 key holder distributing R1 keys only to APs that are entitled to them, and on the mobility domain identifier being the same only for APs under one administrative control. Two failure modes follow.

If an AP is compromised, every station that roamed to it has an R1 key exposed, and the attacker holding the R1 key can impersonate that AP for those stations. The blast radius is bounded by the R1 scope, which is one reason the hierarchy has two levels: the R0 key, from which an R1 key for any AP in the domain can be derived, is confined to the R0 key holder rather than distributed to every access point.

If two administrative domains share a mobility domain identifier by accident or by misconfiguration, a station may attempt a fast transition to an AP that cannot derive the right R1 key, and the attempt fails in a way that looks like a radio problem. The identifier is 2 bytes and is chosen by the operator, so collisions between neighbouring networks are possible and produce exactly this symptom.

The rest of the mobility story is above the link layer. The association a station holds is a link-layer fact; the address it keeps is a network-layer one, and the mechanisms that preserve it across a move, whether proxying, tunnelling, or re-addressing, belong to the network layer. What stays inside is the observation that the faster the link-layer move, the less the layers above have to compensate, and the cost of the compensation is paid in state at the point where the two layers meet.