Scope of Wi-Fi security
IEEE 802.11 frames traverse a shared radio medium. A station within range can receive them without physical cable access. Wi-Fi security must authenticate access, establish keys, and protect frame confidentiality and integrity.
Link-layer protection ends at the access point. It does not replace TLS, application authorization, or internal network segmentation.
WEP failure mechanisms
WEP uses RC4, a shared key, and a 24-bit initialization vector. The small IV space produces reuse under sustained traffic. Its RC4 key construction permits statistical analysis of many frames and eventual WEP key recovery.
Integrity relies on CRC-32, which detects accidental transmission errors but is not a cryptographic authenticator. An attacker can make a predictable data change and adjust the checksum. WEP remains unsuitable regardless of configured passphrase length.
WPA and TKIP
WPA was introduced as a transitional option for some hardware designed for WEP. TKIP extended the IV from 24 to 48 bits, mixed key material with transmitter information, and added the Michael message-integrity mechanism.
TKIP still uses RC4 and retains constraints imposed by legacy compatibility. It should not be selected. A WPA/WPA2 mixed configuration can permit a client to negotiate weaker TKIP protection.
WPA2 and CCMP
WPA2 implements security mechanisms associated with IEEE 802.11i. CCMP uses AES in a construction that combines counter-mode encryption with CBC-MAC authentication. It protects frame content and detects modification.
The does not send the passphrase over radio. It combines master key material, MAC addresses, and nonces to create the PTK session key. A separate GTK protects group traffic.
Personal and Enterprise modes
- WPA2-Personal derives master material from a shared passphrase. Captured authentication material permits offline testing of weak passphrase guesses.
- WPA2-Enterprise uses IEEE 802.1X and EAP. 802.1X controls port-based access, credentials can be individual, and a RADIUS server makes the access decision.
- An Enterprise client should validate the authentication-server certificate. Disabling validation permits infrastructure impersonation.
WPA3-Personal and SAE
WPA3-Personal uses SAE in place of conventional PSK authentication. SAE is a password-authenticated exchange in which each guess requires interaction with the access point. One captured handshake no longer supports unrestricted offline dictionary testing.
SAE provides forward secrecy for earlier sessions after later passphrase disclosure when session keys were not captured. A weak passphrase remains risky because repeated online guesses remain possible. WPA2/WPA3 transition mode advertises PSK and SAE on one BSS. A legacy client can select WPA2, so compatibility retains a weaker path. This mode is not equivalent to WPA3-Personal Only.
Management frames and open networks
Protected Management Frames defend selected management frames, including deauthentication and disassociation, against forgery. PMF is mandatory with WPA3. It does not protect every management frame or prevent radio jamming.
Wi-Fi Enhanced Open uses OWE to establish individual encryption on a network without a shared password. OWE limits passive observation between client and access point, but it does not authenticate the network operator or replace end-to-end protection such as TLS.
An active attacker can still impersonate an access point, connect the client to the legitimate access point, and inspect, modify, or forge data. OWE encrypts the wireless link but does not authenticate the access point.
Current Wi-Fi Alliance certification profiles require a 6 GHz BSS to use WPA3 or Wi-Fi Enhanced Open with Protected Management Frames. WPA2-Personal and legacy open authentication are not permitted for such a BSS. Classic WPA3-Personal Transition Mode is not the 6 GHz configuration, while newer Compatibility Mode has separate rules for that band. Available channels, transmit power, device classes, and certification requirements depend on the region and the certified implementation.
Mechanism selection
- A home network should use WPA3-Personal or WPA2 with CCMP for incompatible devices.
- An organizational network should use Enterprise mode, individual credentials, and server-certificate validation.
- WEP, TKIP, and PIN-based WPS should be disabled.
- Access-point and client updates are part of protocol security.