Wi-Fi Protected Access 3 (WPA3) compared to WPA2.
The newest WPA3 compared to WPA2 introduces stronger encryption, better password-protected authentication, better security for open public networks, and mandatory protection of management frames. Wi-Fi Security usually involves authentication (Personal or Enterprise) between the AP (access point) and the STA (client device) that verifies their credentials and is also used for encryption of the data transferred between them.
WPA3-Personal replaces the WPA2-Personal Pre-Shared Key (PSK) mode with the Simultaneous Authentication of Equals (SAE), a password-authenticated key exchange which provides stronger resistance to offline dictionary attacks. WPA3-Personal modes don't allow the use of WEP, TKIP and WPA security protocol.
1. WPA3-Personal Mode supports SAE only, doesn't allow PSK methods, Wi-Fi 7 devices must support newer SAE AKM suites, GCMP-256 encryption and requires Protected Management Frames (PMF).
2. WPA3-Personal Transition Mode supports both WPA2-Personal (PSK) and WPA3-Personal (SAE) that helps with migration from WPA2 and allows legacy devices to operate using PSK. Clients' devices that are capable of WPA3 should choose SAE. If the SAE is negotiated, then the PMF is required. The transition mode should help with gradual migration while maintaining compatibility. Even though the transition mode is useful during migration from WPA2 to WPA3 and for legacy devices, it still leaves devices vulnerable to downgrade attacks.
3. WPA3-Personal SAE-PK Mode (Simultaneous Authentication of Equals - Public Key) extends SAE with a Public-Key Authentication and protects against rogue access points and "evil twin" attacks. Traditional shared-password Wi-Fi networks are vulnerable to "evil twin" attacks because anyone who knows the password can impersonate an access point. In WPA2 with PSK all the STA share the same password and generate an identical PMK (Pairwise Master Key). Therefore, if an attacker captures PMK of one STA, it can derive the AP's keys and compromise the whole BSS (Basic Service Set) and decrypt all the traffic. In WPA3 with SAE, each STA generates unique PMK for each association to an AP. The AP and STA generate the PMK and PTK (Pairwise Transient Key) via four-way handshake and then uses the PTK to encrypt the data traffic. The SAE-PK solves this by adding a public/private key pair to the Access Point where the password is derived from a fingerprint of the AP's public key and verifies digital signature during authentication. Therefore, users can use relatively simple passwords. The passwords act as a trust anchor for the AP's public key, and even though the attacker may know the password it cannot impersonate the access point without the private key. This makes the WPA3 suitable for public environments such as restaurants, cafes, shops, and hotels with passwords openly displayed to the public.
The STA selects the Authentication and Key Management (AKM) from available methods for Personal networks:
WPA3-SAE Personal settings for 6GHz and Wi-Fi 7 (Cisco WLC C9800 IOS-XE)
In addition, the Wi-Fi 7 mandates support for the protected management frames (PMF) which is also a requirement for the WPA3. The Wi-Fi 7 requires support for the WPA3, where AP and STA are required to support Opportunistic Wireless Encryption (OWE) when connecting in open networks. This Enhanced Open OWE provides encryption to open networks without passwords in public environments (airports, stadiums, schools, and public venues). Therefore, Wi-Fi 7 devices are required support GMAC-256 for stronger encryption.
WPA3 - Enhanced Open / OWE settings for 6GHz and Wi-Fi 7 (Cisco WLC C9800 IOS-XE)
WPA3-Enterprise focuses on business and institutional deployments.
1. WPA3-Enterprise Mode uses 802.1X with SHA-256 AKMs, requires PMF, and doesn't allow SHA-1 Enterprise.
2. WPA3-Enterprise Transition Mode supports both legacy WPA2-Enterprise and WPA3-Enterprise that helps with migration from WPA2 and allows legacy devices to operate while PMF is optional.
3. WPA3-Enterprise 192-bit Mode is intended for high-security settings such as critical infrastructure, government, and defense, it uses Suite B 192-bit cryptography, supports suites based on AES-256-GCM, and PMF is mandatory.
The STA selects the Authentication and Key Management (AKM) from available methods for Enterprise networks:
WPA2/WPA3 Transition mode for Enterprise (802.1X) for 6GHz and Wi-Fi 7 (C9800 IOS-XE)
The WPA3 requires privacy-enhancing behavior by default where devices must use randomized MAC addresses while scanning, and generate unique MAC addresses per SSID which avoids exposing factory-assigned global MAC addresses. Devices must follow privacy procedures when MAC addresses change because sequence numbers can link different MAC addresses together. Devices must avoid predictable scrambler behavior that could reveal identity across randomized MAC addresses. Therefore, randomized identifiers must be used during network discovery to make tracking more difficult or completely avoidable.
The WPA3 specification also adds security requirements to Wi-Fi 7 Multi-Link Devices (MLD) where authentication and association procedures must maintain consistency across links to prevent security holes in Multi-Link Operation (MLO). The unicast traffic can be transmitted on any of the multiple links with the same encryption keys. On the other hand, the multicast traffic is replicated and transmitted on all the multiple links each with a unique encryption key per link.
WPA3 6GHz and Wi-Fi 7 constrains: The 6GHz Spectrum specification prohibits TKIP, WPA3 transition modes, SHA-1 enterprise authentication and open authentication without encryption, where PMF is mandatory. When Extremely High Throughput (EHT) or Multi-Link Operation (MLO) are used the PSK-based AKMs, SHA-1 Enterprise authentication, and Legacy open networks are prohibited to make sure that next-generation Wi-Fi 7 operates with modern security standards. The Wi-Fi 7 requires the Beacon protection for both AP and STA to make sure that the Beacon frames will not be impersonated by an illegitimate Access Point.
From my WLAN deployment experience the Enhanced Open with OWE in Wi-Fi 7 and 6GHz spectrum works flawlessly as long as the users' devices support WPA3 standard. On the other hand, I have encountered multiple issues in the WPA3-Enterprise Transition Mode with WPA2/WPA3 either with outdated Windows drivers that created connecting and reconnecting issues or Apple MacBook laptops took extra-long time to connect via 802.1X authentication.
Even though, the new specification ensures backward compatibility with strong security in mind to secure wireless networks across private, enterprise, and high-security environment it will take some time to tune all the security enhancements to work flawlessly especially with so many different hardware and operating systems versions in the Wi-Fi ecosystem.
Resources:
Comments: