diff --git a/sys/net80211/ieee80211_crypto.h b/sys/net80211/ieee80211_crypto.h
--- a/sys/net80211/ieee80211_crypto.h
+++ b/sys/net80211/ieee80211_crypto.h
@@ -210,6 +210,7 @@
 	u_int	ic_header;		/* size of privacy header (bytes) */
 	u_int	ic_trailer;		/* size of privacy trailer (bytes) */
 	u_int	ic_miclen;		/* size of mic trailer (bytes) */
+	u_int	ic_max_keylen;		/* maximum key length (bytes) */
 	void*	(*ic_attach)(struct ieee80211vap *, struct ieee80211_key *);
 	void	(*ic_detach)(struct ieee80211_key *);
 	int	(*ic_setkey)(struct ieee80211_key *);
@@ -266,6 +267,8 @@
 	k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
 }
 
+int	ieee80211_crypto_get_max_keylen(int cipher);
+
 /*
  * Crypt-related notification methods.
  */
diff --git a/sys/net80211/ieee80211_crypto.c b/sys/net80211/ieee80211_crypto.c
--- a/sys/net80211/ieee80211_crypto.c
+++ b/sys/net80211/ieee80211_crypto.c
@@ -883,3 +883,20 @@
 
 	vap->iv_update_deftxkey(vap, kid);
 }
+
+/*
+ * Return the maximum key (not MIC or IV) size for the given cipher.
+ *
+ * Returns 0 if the cipher isn't defined/loaded.
+ */
+int
+ieee80211_crypto_get_max_keylen(int cipher)
+{
+	const struct ieee80211_cipher *cip;
+
+	cip = ciphers[cipher];
+	if (cip == NULL)
+		return 0;
+
+	return cip->ic_max_keylen;
+}
diff --git a/sys/net80211/ieee80211_crypto_ccmp.c b/sys/net80211/ieee80211_crypto_ccmp.c
--- a/sys/net80211/ieee80211_crypto_ccmp.c
+++ b/sys/net80211/ieee80211_crypto_ccmp.c
@@ -76,6 +76,7 @@
 			  IEEE80211_WEP_EXTIVLEN,
 	.ic_trailer	= IEEE80211_WEP_MICLEN,
 	.ic_miclen	= 0,
+	.ic_max_keylen	= 128 / NBBY,
 	.ic_attach	= ccmp_attach,
 	.ic_detach	= ccmp_detach,
 	.ic_setkey	= ccmp_setkey,
diff --git a/sys/net80211/ieee80211_crypto_tkip.c b/sys/net80211/ieee80211_crypto_tkip.c
--- a/sys/net80211/ieee80211_crypto_tkip.c
+++ b/sys/net80211/ieee80211_crypto_tkip.c
@@ -67,6 +67,7 @@
 			  IEEE80211_WEP_EXTIVLEN,
 	.ic_trailer	= IEEE80211_WEP_CRCLEN,
 	.ic_miclen	= IEEE80211_WEP_MICLEN,
+	.ic_max_keylen	= 128 / NBBY,
 	.ic_attach	= tkip_attach,
 	.ic_detach	= tkip_detach,
 	.ic_setkey	= tkip_setkey,
diff --git a/sys/net80211/ieee80211_crypto_wep.c b/sys/net80211/ieee80211_crypto_wep.c
--- a/sys/net80211/ieee80211_crypto_wep.c
+++ b/sys/net80211/ieee80211_crypto_wep.c
@@ -62,6 +62,7 @@
 	.ic_header	= IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN,
 	.ic_trailer	= IEEE80211_WEP_CRCLEN,
 	.ic_miclen	= 0,
+	.ic_max_keylen	= 108 / NBBY,
 	.ic_attach	= wep_attach,
 	.ic_detach	= wep_detach,
 	.ic_setkey	= wep_setkey,