iOS 14 Wi-Fi MAC address randomization

Summary

This is a report of Wi-Fi MAC address randomization functionality of iOS14.

• iOS 13: Only Probe Request MAC address is randomized.
• iOS 14: Randomized Probe Request(Broadcast) MAC address is also used by auth/assoc/EAPOL.
• Roaming to identical SSID does not modify MAC address.
• Roaming to identical AP with different SSID modify MAC address.
• Disable/Enable Wi-Fi and rebooting iPhone does not modify MAC address.

Detail

Detail of the investigation.

Assume the STA connected to AP1 (SSID=ssid1, BSSID=bssid1) with MAC address A.

Connected to AP2 with identical SSID (SSID=ssid1, BSSID=bssid2)
=> MAC address stays on A

Modify SSID of AP1 and connect to AP1 (SSID=ssid2, BSSID=bssid1)
=> MAC address is modified to B

Restore AP1 configuration (SSID=ssid1, BSSID=bssid1)
=> MAC address backs to A

Disable/Enable Wi-Fi and connect to AP1 (SSID=ssid1, BSSID=bssid1)
=> MAC address stays on A

Reboot iPhone and connect to AP1 (SSID=ssid1, BSSID=bssid1)
=> MAC address stays on A

※ Tested on iPhone 8 Plus with iOS 14