Microsoft VSA · attr 17 · type octets

MS-MPPE-Recv-Key

MS-MPPE-Recv-Key is an encrypted-key VSA (vendor 311, attribute 17) the RADIUS server returns so the NAS can key the session. If a proxy strips it, WPA2-Enterprise Wi-Fi fails after a "successful" auth.

Also searched as: MS-MPPE-Recv-Key missing, MPPE receive key. Defined in RFC 2548 (Microsoft vendor 311).

What it means

For EAP methods, the RADIUS server derives keying material from the successful handshake and hands it to the access point in the paired MS-MPPE-Send-Key and MS-MPPE-Recv-Key attributes (encrypted under the shared secret). The AP needs these to complete the 4-way handshake and actually encrypt Wi-Fi traffic. Authentication can look successful in the server log while the client still can't pass traffic — because the keys never reached the AP.

How it's used

You don't set these by hand; the EAP server generates them. Your job is to make sure nothing between the server and the AP drops them — a RADIUS proxy that doesn't carry VSAs, or a wrong shared secret that garbles the decryption, are the usual culprits.

Common gotchas

• A RADIUS proxy that doesn't forward vendor attributes strips the MPPE keys; the client authenticates but can never associate. Look here when EAP "succeeds" but Wi-Fi still won't connect.
• A mismatched shared secret between proxy hops corrupts the key decryption even when the auth itself passes.