Abstract: During operation, an access point may receive, from an electronic device, a roaming request, where the electronic device is currently associated with a second access point. In response, the access point may broadcast a message in a network, which includes the access point and the second access point. Note that the message may include an L2 look-up message. In some embodiments, the message is only conveyed to the second access point via a router or a switch in the network. Then, the access point may receive, from the second access point, PMK information, where the second access point is included in a subset in the network with the access point. Next, based at least in part on the PMK information, the access point may generate a PMK for use during secure communication with the electronic device and may perform a fast BSS transition with the electronic device.

Abstract: During operation, an access point may provide a first WLAN and a second WLAN, where the first WLAN uses a WPA2-compatible authentication protocol and the second WLAN uses a WPA3-compatible authentication protocol. In response to an association request or a probe request associated with (or from) an electronic device, the access point may establish a connection with the electronic device using the first WLAN. Then, the access point may confirm, with a computer system, that a binding between a passphrase associated with the electronic device and the second WLAN exists. Alternatively, when the binding does not exist, the access point may establish the binding in the computer system. Next, the access point may perform a BSS transition of the electronic device from the first WLAN to the second WLAN.