Security landscape is always evolving and therefore WPA3 was introduced by Wi-Fi alliance to secure modern wifi networks. WPA2 is still widely used by many organizations but WPA3 is eventually going to be replaced since Wi-Fi 6+ standard do require support for WPA3.
WPA3 compared to WPA2
Let's look at how WPA3 solves many of the challenges related to WPA2.
- KRACK vulnerability
There was a huge vulnerability discovered with WPA2 back in 2017 which required a patch to be applied to resolve this problem. This is a problem if you have a secure environment, including corporate environment with WPA2 enterprise. If anyone is using an older client that hasn’t been patched, it could expose your network to malicious attackers.
- Problem with PSK networks
With WPA2 personal, the actual passpharse is used to complete authentication and derive encryption keys to encrypt the traffic. This will allow attackers to be able to sniff the 4-way handshake and run a brute force attack to decrypt the traffic. This would also allow attackers to sniff the traffic and decrypt at a later date, exposing data traversed in the air.
- Open networks
Guest/Public networks provides no encryption, allowing attackers to simply sniff the traffic over the air and see any users data traversing through the open WiFi network.
How WPA3 solves this challenge
- WPA3 is a newer certification that includes different standards to enhance security for modern WiFi networks. It is not vulnerable to KRACK vulnerabilities so there is no worry about a legacy client exposing a secure network to malicious users as long as we are using only WPA3 encryption.
- WPA3 Personal also uses enhanced security in order to prevent issues that existed on WPA2 networks.
- WPA2 personal networks uses SAE/Simulatanous Authentication of Equals in order to authenticate and encrypt data over wifi. With SAE, the actual passphrase is never shared over the wireless network, making it very difficult for malicious users to derive encryption keys to decrypt the traffic.
- SAE uses Diffie—Hellman Elliptic Cryptography, which is a very secure /mathematically complex way to derive encryption keys which would make it very diffcult for attackers to perform brute force.
- SAE would also allow for forward secrecy, meaning the attacker won’t be able to decrypt the traffic at a later date since STA and AP will create different keys at each session.
- Although OWE (Opportunistic Wireless Encryption) is not part of WPA3 certification, OWE is likely going to be supported on any clients that support WPA3. OWE is part of Enhanced Open WiFi certification which would allow clients to use encryption key to encrypt the traffic but without any authentication. This is essentially very similar to how SAE performs the encryption but without any authentication in place.
- This would allow for encryption which would prevent attackers from sniffing the traffic, making the open networks more secured.
- This is not a substitute for WPA3 for corporate environment as this mechanism would still allow for man-in-the-middle attacks by malicious users placing rogue APs in the environment, allowing clients to connect to the rogue device instead of an actual company’s AP.
WPA3 Enterprise
- WPA3 enterprise also provides additional enhancements, especially with a very secure wpa3-enterprise 192 bit mode. WPA3 enterprise still uses AES128 bit encryption but has an optional mode for using GCMP 256 bit mode for encryption with SHA384. This optional mode is aimed at very secure regulatory controlled entities such as governments and is also known as ‘quantum safe’.
In summary, I wanted to highlight some of the core differences between WPA2 and WPA3 and how WPA3 is aimed at solving ever evolving security threats in the wifi world.
On a side note, if you are curious about how Elliptical Curve Cryptography works, here is a great video I have found: