diff --git a/tests/hwsim/hostapd.py b/tests/hwsim/hostapd.py
index 4430d8055..c8021ffcc 100644
--- a/tests/hwsim/hostapd.py
+++ b/tests/hwsim/hostapd.py
@@ -151,6 +151,7 @@ class Hostapd:
         self.mon.attach()
         self.bssid = None
         self.bssidx = bssidx
+        self.extKeyID = None
 
     def cmd_execute(self, cmd_array, shell=False):
         if self.hostname is None:
@@ -536,7 +537,7 @@ def add_ap(apdev, params, wait_enabled=True, no_enable=False, timeout=30,
             raise Exception("Could not ping hostapd")
         hapd.set_defaults()
         fields = ["ssid", "wpa_passphrase", "nas_identifier", "wpa_key_mgmt",
-                  "wpa",
+                  "wpa", "wpa_extended_key_id",
                   "wpa_pairwise", "rsn_pairwise", "auth_server_addr",
                   "acct_server_addr", "osu_server_uri"]
         for field in fields:
@@ -554,6 +555,16 @@ def add_ap(apdev, params, wait_enabled=True, no_enable=False, timeout=30,
             return hapd
         hapd.enable()
         if wait_enabled:
+            if "wpa" in params and params["wpa"]  == "2":
+                ev = hapd.wait_event(["Extended Key ID"], timeout=5)
+                if ev is None or "requires wpa2" in ev:
+                    hapd.extKeyID = "unused"
+                elif "not supported" in ev:
+                    hapd.extKeyID = "auto-off"
+                elif "disabled" in ev:
+                    hapd.extKeyID = "force-off"
+                else:
+                    hapd.extKeyID = "auto-on"
             ev = hapd.wait_event(["AP-ENABLED", "AP-DISABLED"], timeout=timeout)
             if ev is None:
                 raise Exception("AP startup timed out")
@@ -619,7 +630,7 @@ def terminate(apdev):
     hapd_global = HostapdGlobal(apdev)
     hapd_global.terminate()
 
-def wpa2_params(ssid=None, passphrase=None):
+def wpa2_params(ssid=None, passphrase=None, wpa_extended_key_id="auto"):
     params = {"wpa": "2",
               "wpa_key_mgmt": "WPA-PSK",
               "rsn_pairwise": "CCMP"}
@@ -627,6 +638,10 @@ def wpa2_params(ssid=None, passphrase=None):
         params["ssid"] = ssid
     if passphrase:
         params["wpa_passphrase"] = passphrase
+    if wpa_extended_key_id == "on":
+        params["wpa_extended_key_id"] = "1"
+    elif wpa_extended_key_id == "off":
+        params["wpa_extended_key_id"] = "0"
     return params
 
 def wpa_params(ssid=None, passphrase=None):
diff --git a/tests/hwsim/test_ap_eap.py b/tests/hwsim/test_ap_eap.py
index 2fc6925a1..6fc208d20 100644
--- a/tests/hwsim/test_ap_eap.py
+++ b/tests/hwsim/test_ap_eap.py
@@ -6535,7 +6535,7 @@ def test_eap_tls_sha384(dev, apdev, params):
 def test_ap_wpa2_eap_assoc_rsn(dev, apdev):
     """WPA2-Enterprise AP and association request RSN IE differences"""
     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap")
-    hostapd.add_ap(apdev[0], params)
+    hapd = hostapd.add_ap(apdev[0], params)
 
     params = hostapd.wpa2_eap_params(ssid="test-wpa2-eap-11w")
     params["ieee80211w"] = "2"
@@ -6555,6 +6555,17 @@ def test_ap_wpa2_eap_assoc_rsn(dev, apdev):
              ("RSN IE without AKM", "300c0100000fac040100000fac04"),
              ("RSN IE without pairwise", "30060100000fac04"),
              ("RSN IE without group", "30020100")]
+
+    if hapd.extKeyID == "auto-on":
+        tests += [("Normal wpa_supplicant assoc req RSN IE with Extended Key ID",
+                   "30140100000fac040100000fac040100000fac010020"),
+                  ("Extra PMKIDCount field in RSN IE with Extended Key ID",
+                   "30160100000fac040100000fac040100000fac0100200000"),
+                  ("Extra Group Management Cipher Suite in RSN IE with Extended Key ID",
+                   "301a0100000fac040100000fac040100000fac0100200000000fac06"),
+                  ("Extra undefined extension field in RSN IE with Extended Key ID",
+                   "301c0100000fac040100000fac040100000fac0100200000000fac061122")]
+
     for title, ie in tests:
         logger.info(title)
         set_test_assoc_ie(dev[0], ie)
@@ -6569,6 +6580,13 @@ def test_ap_wpa2_eap_assoc_rsn(dev, apdev):
               "30140100000fac040100000fac040100000fac01cc00"),
              ("Group management cipher included in assoc req RSN IE",
               "301a0100000fac040100000fac040100000fac01cc000000000fac06")]
+
+    if hapd.extKeyID == "auto-on":
+        tests += [("Normal wpa_supplicant assoc req RSN IE with Extended Key ID",
+                   "30140100000fac040100000fac040100000fac01cc20"),
+                  ("Group management cipher included in assoc req RSN IE with Extended Key ID",
+                   "301a0100000fac040100000fac040100000fac01cc200000000fac06")]
+
     for title, ie in tests:
         logger.info(title)
         set_test_assoc_ie(dev[0], ie)
diff --git a/tests/hwsim/test_ap_psk.py b/tests/hwsim/test_ap_psk.py
index 2655c960c..9bb996f09 100644
--- a/tests/hwsim/test_ap_psk.py
+++ b/tests/hwsim/test_ap_psk.py
@@ -203,16 +203,56 @@ def _test_ap_wpa2_psk_mem(dev, apdev):
 
 @remote_compatible
 def test_ap_wpa2_ptk_rekey(dev, apdev):
-    """WPA2-PSK AP and PTK rekey enforced by station"""
+    """WPA2-PSK AP and PTK rekey enforced by station without Extended Key ID"""
+    ssid = "test-wpa2-psk"
+    passphrase = 'qwertyuiop'
+    params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase,
+                                 wpa_extended_key_id="off")
+    hapd = hostapd.add_ap(apdev[0], params)
+    dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412",
+                   wpa_extended_key_id="off")
+    ev = dev[0].wait_event(["WPA: Key negotiation completed"])
+    if ev is None:
+        raise Exception("PTK rekey timed out")
+    hwsim_utils.test_connectivity(dev[0], hapd)
+
+def test_ap_wpa2_ptk_extended_key_id_rekey(dev, apdev):
+    """WPA2-PSK AP and PTK rekey enforced by station with Extended Key ID"""
     ssid = "test-wpa2-psk"
     passphrase = 'qwertyuiop'
     params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase)
     hapd = hostapd.add_ap(apdev[0], params)
+    if hapd.extKeyID == "auto-off":
+        raise Exception("Extended Key ID support missing in hwsim")
+
+    dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412",
+                   wpa_extended_key_id="off")
+    ev = dev[0].wait_event(["WPA: Key negotiation completed"])
+    if ev is None:
+        raise Exception("PTK rekey timed out (STA without Extended Key ID)")
+    hwsim_utils.test_connectivity(dev[0], hapd)
+    dev[0].reset()
+
     dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412")
     ev = dev[0].wait_event(["WPA: Key negotiation completed"])
     if ev is None:
-        raise Exception("PTK rekey timed out")
+        raise Exception("PTK rekey timed out (STA with Extended Key ID)")
+    hwsim_utils.test_connectivity(dev[0], hapd)
+    ev = dev[0].wait_event(["WPA: Key negotiation completed"])
+    if ev is None:
+        raise Exception("PTK rekey timed out 2 (STA with Extended Key ID)")
     hwsim_utils.test_connectivity(dev[0], hapd)
+    dev[0].reset()
+
+    params = hostapd.wpa2_params(ssid=ssid, passphrase=passphrase,
+                                 wpa_extended_key_id="off")
+    hapd = hostapd.add_ap(apdev[0], params)
+    dev[0].connect(ssid, psk=passphrase, wpa_ptk_rekey="1", scan_freq="2412")
+    ev = dev[0].wait_event(["WPA: Key negotiation completed"])
+    if ev is None:
+        raise Exception("PTK rekey timed out (AP without Extended Key ID")
+    hwsim_utils.test_connectivity(dev[0], hapd)
+    dev[0].reset()
 
 def test_ap_wpa2_ptk_rekey_anonce(dev, apdev):
     """WPA2-PSK AP and PTK rekey enforced by station and ANonce change"""
@@ -1355,10 +1395,15 @@ def eapol_test(apdev, dev, wpa2=True, ieee80211w=0):
                 ieee80211w=str(ieee80211w))
     addr = dev.p2p_interface_addr()
     if wpa2:
-        if ieee80211w == 2:
-            rsne = binascii.unhexlify('30140100000fac040100000fac040100000fac02cc00')
+        if hapd.extKeyID == "auto-on" and ieee80211w == 2:
+            cap = "cc20"
+        elif hapd.extKeyID == "auto-on":
+            cap = "0020"
+        elif ieee80211w == 2:
+            cap = "cc00"
         else:
-            rsne = binascii.unhexlify('30140100000fac040100000fac040100000fac020000')
+            cap = "0000"
+        rsne = binascii.unhexlify('30140100000fac040100000fac040100000fac02'+cap)
     else:
         rsne = binascii.unhexlify('dd160050f20101000050f20201000050f20201000050f202')
     snonce = binascii.unhexlify('1111111111111111111111111111111111111111111111111111111111111111')
@@ -2928,6 +2973,11 @@ def test_ap_wpa2_psk_assoc_rsn(dev, apdev):
               "30140100000fac040100000fac040100000fac020000"),
              ("RSN IE without RSN Capabilities",
               "30120100000fac040100000fac040100000fac02")]
+
+    if hapd.extKeyID == "auto-on":
+        tests += [("Normal wpa_supplicant assoc req RSN IE with Extended Key ID",
+                   "30140100000fac040100000fac040100000fac020020")]
+
     for title, ie in tests:
         logger.info(title)
         set_test_assoc_ie(dev[0], ie)
@@ -2971,9 +3021,13 @@ def test_ap_wpa2_psk_ft_workaround(dev, apdev):
     params['r1_key_holder'] = "000102030405"
     hapd = hostapd.add_ap(apdev[0], params)
 
+    if hapd.extKeyID == "auto-on":
+        ie = "30180100000fac040100000fac040200000fac02000fac040020"
+    else:
+        ie = "30180100000fac040100000fac040200000fac02000fac040000"
+
     # Include both WPA-PSK and FT-PSK AKMs in Association Request frame
-    set_test_assoc_ie(dev[0],
-                      "30180100000fac040100000fac040200000fac02000fac040000")
+    set_test_assoc_ie(dev[0], ie)
     dev[0].connect(ssid, psk=passphrase, scan_freq="2412")
     dev[0].request("REMOVE_NETWORK all")
     dev[0].wait_disconnected()
@@ -2990,6 +3044,14 @@ def test_ap_wpa2_psk_assoc_rsn_pmkid(dev, apdev):
     dev[0].request("REMOVE_NETWORK all")
     dev[0].wait_disconnected()
 
+    if not hapd.extKeyID == "auto-on":
+        return
+
+    set_test_assoc_ie(dev[0], "30260100000fac040100000fac040100000fac0200200100" + 16*'00')
+    dev[0].connect(ssid, psk=passphrase, scan_freq="2412")
+    dev[0].request("REMOVE_NETWORK all")
+    dev[0].wait_disconnected()
+
 def test_ap_wpa_psk_rsn_pairwise(dev, apdev):
     """WPA-PSK AP and only rsn_pairwise set"""
     params = {"ssid": "wpapsk", "wpa": "1", "wpa_key_mgmt": "WPA-PSK",
diff --git a/tests/hwsim/test_ocv.py b/tests/hwsim/test_ocv.py
index 176e17faf..7787a4056 100644
--- a/tests/hwsim/test_ocv.py
+++ b/tests/hwsim/test_ocv.py
@@ -380,10 +380,17 @@ class APConnection:
         self.bssid = apdev['bssid']
         pmk = binascii.unhexlify("c2c6c255af836bed1b3f2f1ded98e052f5ad618bb554e2836757b55854a0eab7")
 
-        if sta_ocv != "0":
-            self.rsne = binascii.unhexlify("301a0100000fac040100000fac040100000fac0280400000000fac06")
+        if self.hapd.extKeyID == "auto-on":
+            if sta_ocv != "0":
+                cap = "8060"
+            else:
+                cap = "8020"
         else:
-            self.rsne = binascii.unhexlify("301a0100000fac040100000fac040100000fac0280000000000fac06")
+            if sta_ocv != "0":
+                cap = "8040"
+            else:
+                cap = "8000"
+        self.rsne = binascii.unhexlify("301a0100000fac040100000fac040100000fac02"+cap+"0000000fac06")
         self.snonce = binascii.unhexlify('1111111111111111111111111111111111111111111111111111111111111111')
 
         dev.connect(self.ssid, raw_psk=self.psk, scan_freq=freq, ocv=sta_ocv,
diff --git a/tests/hwsim/test_rrm.py b/tests/hwsim/test_rrm.py
index c9c8d6103..4f2a323c2 100644
--- a/tests/hwsim/test_rrm.py
+++ b/tests/hwsim/test_rrm.py
@@ -1182,6 +1182,11 @@ def test_rrm_beacon_req_table_rsne(dev, apdev):
     params["rrm_beacon_report"] = "1"
     hapd = hostapd.add_ap(apdev[0], params)
 
+    if hapd.extKeyID == "auto-on":
+        cap = "0c20"
+    else:
+        cap = "0c00"
+
     dev[0].connect("rrm-rsn", psk="12345678", scan_freq="2412")
     addr = dev[0].own_addr()
 
@@ -1196,7 +1201,7 @@ def test_rrm_beacon_req_table_rsne(dev, apdev):
         raise Exception("Reported Frame Body subelement missing")
     if len(report.frame_body) != 12 + 22:
         raise Exception("Unexpected Reported Frame Body subelement length with Reporting Detail 1 and requested element RSNE")
-    if binascii.unhexlify("30140100000fac040100000fac040100000fac020c00") not in report.frame_body:
+    if binascii.unhexlify("30140100000fac040100000fac040100000fac02"+cap) not in report.frame_body:
         raise Exception("Full RSNE not found")
 
 def test_rrm_beacon_req_table_vht(dev, apdev):
diff --git a/tests/hwsim/wpasupplicant.py b/tests/hwsim/wpasupplicant.py
index 8c7e13d02..c02aca409 100644
--- a/tests/hwsim/wpasupplicant.py
+++ b/tests/hwsim/wpasupplicant.py
@@ -1053,13 +1053,18 @@ class WpaSupplicant:
         if tspecs:
             raise Exception("DELTS failed (still in tspec list)")
 
-    def connect(self, ssid=None, ssid2=None, **kwargs):
+    def connect(self, ssid=None, ssid2=None,
+                wpa_extended_key_id="auto", **kwargs):
         logger.info("Connect STA " + self.ifname + " to AP")
         id = self.add_network()
         if ssid:
             self.set_network_quoted(id, "ssid", ssid)
         elif ssid2:
             self.set_network(id, "ssid", ssid2)
+        if wpa_extended_key_id == "on":
+            self.set_network(id, "wpa_extended_key_id", "1")
+        elif wpa_extended_key_id == "off":
+            self.set_network(id, "wpa_extended_key_id", "0")
 
         quoted = ["psk", "identity", "anonymous_identity", "password",
                   "ca_cert", "client_cert", "private_key",
diff --git a/wlantest/bss.c b/wlantest/bss.c
index 298a902c7..08181dc8c 100644
--- a/wlantest/bss.c
+++ b/wlantest/bss.c
@@ -334,7 +334,9 @@ void bss_update(struct wlantest *wt, struct wlantest_bss *bss,
 		   bss->rsn_capab & WPA_CAPABILITY_MFPC ? "MFPC " : "",
 		   bss->rsn_capab & WPA_CAPABILITY_PEERKEY_ENABLED ?
 		   "PEERKEY " : "",
-		   bss->rsn_capab & WPA_CAPABILITY_OCVC ? "OCVC " : "");
+		   bss->rsn_capab & WPA_CAPABILITY_OCVC ? "OCVC " : "",
+		   bss->rsn_capab & WPA_CAPABILITY_EXT_KEY_ID_FOR_UNICAST ?
+		   "Extended Key ID" : "");
 }
 
 
diff --git a/wlantest/rx_eapol.c b/wlantest/rx_eapol.c
index 1af48ec8f..4d692e09a 100644
--- a/wlantest/rx_eapol.c
+++ b/wlantest/rx_eapol.c
@@ -458,6 +458,10 @@ static void learn_kde_keys(struct wlantest *wt, struct wlantest_bss *bss,
 			    ie.rsn_ie, ie.rsn_ie_len);
 	}
 
+	if (ie.key_id) {
+		add_note(wt, MSG_DEBUG, "KeyID %u", ie.key_id[0]);
+	}
+
 	if (ie.gtk) {
 		wpa_hexdump(MSG_MSGDUMP, "EAPOL-Key Key Data - GTK KDE",
 			    ie.gtk, ie.gtk_len);
