diff --git a/sys/net80211/ieee80211_crypto.h b/sys/net80211/ieee80211_crypto.h
--- a/sys/net80211/ieee80211_crypto.h
+++ b/sys/net80211/ieee80211_crypto.h
@@ -94,6 +94,7 @@
 
 	ieee80211_keyix	wk_keyix;	/* h/w key index */
 	ieee80211_keyix	wk_rxkeyix;	/* optional h/w rx key index */
+	/* TODO: deprecate direct access to wk_key, wk_txmic, wk_rxmic */
 	uint8_t		wk_key[IEEE80211_KEYBUF_SIZE+IEEE80211_MICBUF_SIZE];
 #define	wk_txmic	wk_key+IEEE80211_KEYBUF_SIZE+0	/* XXX can't () right */
 #define	wk_rxmic	wk_key+IEEE80211_KEYBUF_SIZE+8	/* XXX can't () right */
@@ -300,5 +301,109 @@
 uint16_t	ieee80211_crypto_init_aad(const struct ieee80211_frame *,
 		uint8_t *, int);
 
+/**
+ * @brief Return the key data.
+ *
+ * This returns a pointer to the key data.  Note it does not
+ * guarantee the TX/RX MIC will be immediately after the key.
+ * Callers must use ieee80211_crypto_get_key_txmic_data()
+ * and ieee80211_crypto_get_key_rxmic_data() for that.
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns NULL if no key data is available, or a pointer
+ *  to the key data.
+ */
+static inline const uint8_t *
+ieee80211_crypto_get_key_data(const struct ieee80211_key *k)
+{
+	return (k->wk_key);
+}
+
+/**
+ * @brief Return the key length in bytes.
+ *
+ * This doesn't include any TX/RX MIC (eg from TKIP).
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns the key length (without any MIC) in bytes
+ */
+static inline const uint16_t
+ieee80211_crypto_get_key_len(const struct ieee80211_key *k)
+{
+	return (k->wk_keylen);
+}
+
+/**
+ * @brief Return the TX MIC data.
+ *
+ * This returns a pointer to the TX MIC data.
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns NULL if no key data is available, or a pointer
+ *  to the TX MIC data.
+ */
+static inline const uint8_t *
+ieee80211_crypto_get_key_txmic_data(const struct ieee80211_key *k)
+{
+	return (k->wk_txmic);
+}
+
+/**
+ * @brief Return the TX MIC length in bytes.
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns the TX MIC length in bytes
+ */
+static inline const uint16_t
+ieee80211_crypto_get_key_txmic_len(const struct ieee80211_key *k)
+{
+	return (k->wk_cipher->ic_miclen);
+}
+
+/**
+ * @brief Return the RX MIC data.
+ *
+ * This returns a pointer to the RX MIC data.
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns NULL if no key data is available, or a pointer
+ *  to the RX MIC data.
+ */
+static inline const uint8_t *
+ieee80211_crypto_get_key_rxmic_data(const struct ieee80211_key *k)
+{
+	return (k->wk_rxmic);
+}
+
+/**
+ * @brief Return the RX MIC length in bytes.
+ *
+ * Note: there's no locking; this needs to be called in
+ * a situation where the ieee80211_key won't disappear.
+ *
+ * @param k ieee80211_key
+ * @returns the RX MIC length in bytes
+ */
+static inline const uint16_t
+ieee80211_crypto_get_key_rxmic_len(const struct ieee80211_key *k)
+{
+	return (k->wk_cipher->ic_miclen);
+}
+
 #endif /* defined(__KERNEL__) || defined(_KERNEL) */
 #endif /* _NET80211_IEEE80211_CRYPTO_H_ */