Scope of Wi-Fi security
IEEE 802.11 frames traverse a shared radio medium. A station within range can receive them without physical cable access. Wi-Fi security must authenticate access, establish keys, and protect frame confidentiality and integrity.
Link-layer protection ends at the access point. It does not replace TLS, application authorization, or internal network segmentation.
WEP failure mechanisms
WEP uses RC4, a shared key, and a 24-bit initialization vector. The small IV space produces reuse under sustained traffic. Its RC4 key construction permits statistical analysis of many frames and eventual WEP key recovery.
Integrity relies on CRC-32, which detects accidental transmission errors but is not a cryptographic authenticator. An attacker can make a predictable data change and adjust the checksum. WEP remains unsuitable regardless of configured passphrase length.
WPA and TKIP
WPA was introduced as a transitional option for some hardware designed for WEP. TKIP enlarged the IV, mixed key material with transmitter information, and added a message-integrity mechanism.
TKIP still uses RC4 and retains constraints imposed by legacy compatibility. It should not be selected. A WPA/WPA2 mixed configuration can permit a client to negotiate weaker TKIP protection.
WPA2 and CCMP
WPA2 implements security mechanisms associated with IEEE 802.11i. CCMP uses AES in a construction that combines counter-mode encryption with CBC-MAC authentication. It protects frame content and detects modification.
The does not send the passphrase over radio. It combines master key material, MAC addresses, and nonces to create the PTK session key. A separate GTK protects group traffic.
Personal and Enterprise modes
- WPA2-Personal derives master material from a shared passphrase. Captured authentication material permits offline testing of weak passphrase guesses.
- WPA2-Enterprise uses IEEE 802.1X and EAP. Credentials can be individual and a RADIUS server makes the access decision.
- An Enterprise client must validate the authentication-server certificate. Disabling validation permits infrastructure impersonation.
WPA3-Personal and SAE
WPA3-Personal uses SAE in place of conventional PSK authentication. SAE is a password-authenticated exchange in which each guess requires interaction with the access point. One captured handshake no longer supports unrestricted offline dictionary testing.
SAE provides forward secrecy for earlier sessions after later passphrase disclosure when session keys were not captured. A weak passphrase remains risky, and WPA2/WPA3 transition mode retains a weaker compatibility path.
Management frames and open networks
Protected Management Frames defend selected management frames, including deauthentication and disassociation, against forgery. PMF is mandatory with WPA3. It does not protect every management frame or prevent radio jamming.
Wi-Fi Enhanced Open uses OWE to establish individual encryption on a network without a shared password. OWE limits passive observation between client and access point but does not authenticate the network operator.
Mechanism selection
- A home network should use WPA3-Personal or WPA2 with CCMP for incompatible devices.
- An organizational network should use Enterprise mode, individual credentials, and server-certificate validation.
- WEP, TKIP, and PIN-based WPS should be disabled.
- Access-point and client updates are part of protocol security.