2

It is well known that (malicious) endpoints in a Wi-Fi network password-protected by WPA2-Personal can sniff all clear traffic to/from any other endpoint, if they can also capture the 4-way handshake of each connecting device. That information allows them to derive the per-connection link key of other users.

Is that still the case with WPA3-Personal (which doesn't use the same handshake)?

A well-advertised property of WPA3-Personal is that it makes password brute-forcing unfeasible, however in the scenario above, the attacker already knows the password.

Improve this question
6
  • No. As with the password protections, WPA3's expanded encryption for public networks also keeps Wi-Fi users safe from a vulnerability they may not realize exists in the first place. Therefore they are even in public WIFIs protected from other users because they get an own Link key. Anyway WPA3 doesn't use a unsecure 4WHS. They use a Simultaneous Authentication of Equals handshake, which protects the 4WHS with a asymetric encryption.
    – Cyberduck
    Dec 12, 2018 at 8:52
  • This question might be of some help.
    – forest
    Dec 12, 2018 at 9:21
  • 1
    I believe, if the attacker has the password, they can mount a MITM attack.
    – forest
    Dec 12, 2018 at 9:29
  • @forest no it's not possible in WPA3. That's the main difference. every device get's it's own link key.
    – Cyberduck
    Dec 12, 2018 at 9:35
  • @CDRohling Ah, so it's only possible when using OWE? How could that be if a malicious device can do an evil twin attack with the correct password?
    – forest
    Dec 12, 2018 at 9:36

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .