Describe wireless security protocols (WPA, WPA2, and WPA3)

Wireless traffic travels through the air where anyone within range can capture it, so Wi-Fi needs both authentication (only allowed clients join) and encryption (captured frames are unreadable). The Wi-Fi Alliance certifies security methods under the WPA names; each generation replaced a broken predecessor.

The generations

• Open authentication: no authentication and no encryption. Anyone can join and everything is readable. Used for guest hotspots, usually with a captive web portal for terms acceptance. Offers no security.
• WEP (Wired Equivalent Privacy): the original 802.11 method, using the RC4 cipher with 40- or 104-bit static keys. Deeply flawed; a WEP key can be recovered in minutes with free tools. Never use it; it exists on the exam only as “the broken one.”
• WPA (Wi-Fi Protected Access): a 2003 interim fix that ran on WEP-era hardware. It uses TKIP (Temporal Key Integrity Protocol), which still uses RC4 but with per-packet keys and a message integrity check. Considered weak today.
• WPA2 (2004, based on the 802.11i standard): replaces TKIP with AES encryption using CCMP (Counter Mode with CBC-MAC Protocol). Still the most widely deployed method and secure when a strong passphrase is used.
• WPA3 (2018): the current standard. Introduces GCMP (Galois/Counter Mode Protocol) as a stronger, more efficient AES-based cipher and adds several protocol improvements described below.

Personal versus Enterprise

Each of WPA, WPA2, and WPA3 comes in two modes that differ in how the client authenticates:

• Personal mode uses a pre-shared key (PSK): the same passphrase (8 to 63 ASCII characters) is configured on the AP and on every client. Simple, but the key is shared by everyone and must be changed everywhere if it leaks. Suitable for homes and small offices.
• Enterprise mode uses 802.1X with a RADIUS server: each user or device authenticates individually with its own credentials or certificate, and a unique encryption key is derived per session. Suitable for organizations; requires an authentication server such as Cisco ISE.

WPA3 improvements

• SAE (Simultaneous Authentication of Equals) replaces the PSK exchange in Personal mode. With WPA2-PSK, the four-way handshake that derives session keys from the passphrase can be captured and attacked offline with a dictionary. SAE (also called Dragonfly) is a password-authenticated key exchange in which each side proves knowledge of the password without ever exposing material usable for offline guessing, and it provides forward secrecy (an attacker who later learns the passphrase cannot decrypt previously captured traffic).
• Protected Management Frames (PMF, 802.11w) are required. Management frames such as deauthentication are now authenticated, which defeats deauthentication flood attacks used to knock clients off the network.
• Enhanced Open, based on OWE (Opportunistic Wireless Encryption), gives open networks encryption without a password: each client negotiates a unique key with the AP, so a guest hotspot no longer exposes everyone’s traffic to everyone else. There is still no authentication.
• WPA3-Enterprise 192-bit mode offers an optional higher-security suite (GCMP-256, SHA-384) for government and high-security environments.

802.1X roles

IEEE 802.1X is port-based network access control, used on both wired switch ports and wireless networks. Until a client authenticates, the port (or wireless association) passes only authentication traffic. Three roles are involved:

• Supplicant: the client device (its OS or wireless driver) that wants access and provides credentials.
• Authenticator: the network device the client connects to, a switch or the AP/WLC, which relays the exchange. It does not decide anything itself; it blocks traffic until the server says yes.
• Authentication server: the RADIUS server (Cisco ISE) that validates the credentials and returns accept or reject, possibly with authorization attributes such as a VLAN.

Between supplicant and authenticator, the messages are carried in EAPOL (EAP over LAN); between authenticator and server, they are carried inside RADIUS. EAP (Extensible Authentication Protocol) is the framework; the actual credential check is done by an EAP method: