5

WPA3 uses AES-128 for message encryption in Personal and 192 bits in Enterprise. Thus the secret of communication is kept using this symmetric encryption protocol. As I have understood, security problems in wireless networks usually tend to arise

  • Not due to the encryption algorithm used
    • Using AES 128 would mean trying 2128 combinations, and given the current computing technologies this process is computationally intractable in human feasible time
  • But instead due to the password used
    • Simple passwords would help reduce the space of possible passwords in a dictionary attack, hence the recommendations of using more elaborated passwords.
  • Or instead due to the key sharing process (the handshake)

Is my understanding of this correct?

To be more precise, WPA3 uses AES-CCMP because AES alone only provides data encryption, it does not guarantee integrity or authentication, but CCMP provides both integrity because it makes sure that the original message was not tampered with, thus proving authenticity. Is this information pointing in the right direction? If this is correct, could someone please elaborate a little bit more on this?

0

1 Answer 1

4

(simple passwords would help reduce the space of possible passwords in a dictionary attack, hence the recommendations of using more elaborated pws)

Actually, WPA3 uses a new algorithm called Simultaneous Authentication of Equals (SAE), which defeats offline dictionary and brute force attacks. An attacker is only able to attempt one password guess each time you connect. This is quite different from WPA2, where capturing the 4-way handshake allows an attacker to perform a fast offline attack, potentially guessing billions of candidate passwords per second. While it's still a good idea to use a complex password, failing to do so is not quite as fatal when using WPA3 as when using WPA2.

WPA3 uses AES-CCMP because AES alone only provides data encryption, it does not guarantee integrity or authentication, but CCMP provides both integrity because it makes sure that the original message was not tampered with, thus proving authenticity. Is this information pointing in the right direction?

Correct, with one small correction. Rather than using CCMP, which uses the very slow CCM authenticated mode, WPA3 uses GCMP, which uses GCM.* GCM provides the same level of authentication as CCM without the overhead. It is the mode that is commonly used in modern TLS connections. Below, you can see the comparison of the four main encryption standards for WiFi, including a comparison of the data integrity techniques:

WEP WPA WPA2 WPA3
Brief description Ensure wired-like privacy in wireless Based on 802.11i without requiring
new hardware
New hardware with all mandatory 802.11i features Announced by Wi-Fi Alliance
Encryption RC4 TKIP + RC4 CCMP/AES GCMP-256
Authentication WEP-Open
WEP-Shared
WPA-PSK
WPA-Enterprise
WPA2-Personal
WPA2-Enterprise
WPA3-Personal
WPA3-Enterprise
Data integrity CRC-32 MIC algorithm CBC MAC
(based on AES)
BIP-GMAC-256
Key management none 4-way handshake 4-way handshake ECDH and ECDSA

* I've read conflicting reports on this. It's possible that both CCMP and GCMP will be supported.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .