4

WPA3 uses AES-128 for message encryption in Personal and 192 bits in Enterprise. Thus the secret of communication is kept using this symmetric encryption protocol. As I have understood, security problems in wireless networks usually tend to rise not due to the encryption algorithm used (because using AES 128 would mean trying 2^128 combinations and given the current computing technologies this process is computationally untractable in human feasible time), but due to the password used (simple passwords would help reduce the space of possible passwords in a dictionary attack, hence the recommendations of using more elaborated pws) or due to the key sharing process (the handshake). Is my understanding of this correct?

To be more precise, WPA3 uses AES-CCMP because AES alone only provides data encryption, it does not guarantee integrity or authentication, but CCMP provides both integrity because it makes sure that the original message was not tampered with, thus proving authenticity. Is this information pointing in the right direction? If this is correct, could someone please elaborate a little bit more on this?

  • 1
    These are really good questions in my opinion, but I think you may want to split this into 3 or 4 questions to keep them more narrow - if you do that, someone who can answer one but not all of your questions can provide an answer on the appropriate one, rather than one answer having to encompass all of them. Note that you can edit your question, so you can update this one and make 2 new ones. – IllusiveBrian Sep 29 '18 at 12:26
  • 3
    Welcome to the site and thanks for splitting the question! The numbered titles, however, aren't very helpful to people googling or browsing the site. For this question, would something like "In WPA3, how would one attack the AES-encrypted connection?" be an accurate title? Similarly for the other two questions, please find a title that describes your question more narrowly. It will help others, that may have the same question as you, find the answer :) (By the way, good questions. I learn stuff just by reading your questions!) – Luc Dec 12 '18 at 10:31
  • 1
    This, too needs a more descriptive title – schroeder Dec 12 '18 at 11:44
  • 1
    Title can be changed to what you are asking in this question. Nobody's going to search "WPA 3 doubts". – defalt Dec 12 '18 at 12:41
1

(simple passwords would help reduce the space of possible passwords in a dictionary attack, hence the recommendations of using more elaborated pws)

Actually, WPA3 uses a new algorithm called Simultaneous Authentication of Equals (SAE), which defeats offline dictionary and brute force attacks. An attacker is only able to attempt one password guess each time you connect. This is quite different from WPA2, where capturing the 4-way handshake allows an attacker to perform a fast offline attack, potentially guessing billions of candidate passwords per second. While it's still a good idea to use a complex password, failing to do so is not quite as fatal when using WPA3 as when using WPA2.

WPA3 uses AES-CCMP because AES alone only provides data encryption, it does not guarantee integrity or authentication, but CCMP provides both integrity because it makes sure that the original message was not tampered with, thus proving authenticity. Is this information pointing in the right direction?

Correct, with one small correction. Rather than using CCMP, which uses the very slow CCM authenticated mode, WPA3 uses GCMP, which uses GCM.* GCM provides the same level of authentication as CCM without the overhead. It is the mode that is commonly used in modern TLS connections. Below, you can see the comparison of the four main encryption standards for WiFi, including a comparison of the data integrity techniques:

wifi comparison

* I've read conflicting reports on this. It's possible that both CCMP and GCMP will be supported.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.