A method for establishing security association between mesh nodes of an ad hoc wireless network comprising: performing an initial authentication of a node, the initial authentication comprising: sending an association request from the node to an authenticator node, sending an association response from the authenticator node to the node, wherein the association response includes a key distributor address identifying a the key distributor with which the authenticator node has a pre-existing security association, performing authentication between the node, the key distributor, and an authentication server to create a master session key; deriving a mesh key distributor pairwise master key, PMK-MKD, and a key distribution key, KDK, from the master session key at the key distributor and at the node; deriving a mesh authenticator pairwise master key, PMK-MA, from the PMK-MKD at the key distributor and at the node, sending the PMK-MA from the key distributor to the authenticator node; creating a security association between the node and the authenticator node by performing a four-way handshake between the authenticator node and the node, using the PMK-MA; and performing a key holder setup handshake between the node and the key distributor to create a key distribution pairwise transient key, PTK-KD, from the KDK based on the key distributor address and nonces contributed by the node and the key distributor; broadcasting, by the authenticator node, information to the nodes of the ad hoc wireless network allowing the nodes to join the network, wherein the information broadcasted by the authenticator node comprises an identifier of a mesh security domain that contains the key distributor. performing an initial authentication of a node, the initial authentication comprising: sending an association request from the node to an authenticator node, sending an association response from the authenticator node to the node, wherein the association response includes a key distributor address identifying a the key distributor with which the authenticator node has a pre-existing security association, performing authentication between the node, the key distributor, and an authentication server to create a master session key; deriving a mesh key distributor pairwise master key, PMK-MKD, and a key distribution key, KDK, from the master session key at the key distributor and at the node; deriving a mesh authenticator pairwise master key, PMK-MA, from the PMK-MKD at the key distributor and at the node, sending the PMK-MA from the key distributor to the authenticator node; creating a security association between the node and the authenticator node by performing a four-way handshake between the authenticator node and the node, using the PMK-MA; and sending an association request from the node to an authenticator node, sending an association response from the authenticator node to the node, wherein the association response includes a key distributor address identifying a the key distributor with which the authenticator node has a pre-existing security association, performing authentication between the node, the key distributor, and an authentication server to create a master session key; deriving a mesh key distributor pairwise master key, PMK-MKD, and a key distribution key, KDK, from the master session key at the key distributor and at the node; deriving a mesh authenticator pairwise master key, PMK-MA, from the PMK-MKD at the key distributor and at the node, sending the PMK-MA from the key distributor to the authenticator node; creating a security association between the node and the authenticator node by performing a four-way handshake between the authenticator node and the node, using the PMK-MA; and performing a key holder setup handshake between the node and the key distributor to create a key distribution pairwise transient key, PTK-KD, from the KDK based on the key distributor address and nonces contributed by the node and the key distributor; broadcasting, by the authenticator node, information to the nodes of the ad hoc wireless network allowing the nodes to join the network, wherein the information broadcasted by the authenticator node comprises an identifier of a mesh security domain that contains the key distributor.