3

WPA3 for Wi-Fi systems is generally acknowledged to be more secure than WPA2. For example, it introduces SAE with the Dragonfly handshake, in an attempt to close the door on the kind of brute force dictionary attacks that WPA2 could be susceptible to. However, even WPA3 has its vulnerabilities. Perhaps the most risky of these include:

  1. WPA3 Transition Mode, meant to support a transition period where some devices are not yet WPA3-capable and so, could be exploited to perform downgrade attacks. One canonical way to do this would be with a rogue AP that forces WPA3-capable devices to downgrade to use WPA2 with the rogue AP (by taking advantage of the genuine AP's use of WPA3 Transition Mode).
  2. Side-channel attacks on Dragonfly.

Here's a recent paper that analyzes the security vulnerabilities in WPA3.

While IEEE SA and the Wi-Fi Alliance are working on fixes, together with the vendors, what do we do in the meantime, for the following two cases?

  • I have a WPA3 capable Wi-Fi device/phone
  • I administer a Wi-Fi network in a small office/home environment. All the APs are WPA3-capable.
9
  • If there is a rogue AP that knows the PSK, they could already trick clients into connecting, allowing monitoring of all traffic without attacking WPA3 at all. May 29, 2020 at 17:10
  • 1
    We need to divide the clients into those that have previously connected to the genuine AP, and those that haven't. For those that previously haven't, all bets are off, sure. For those that have previously connected, typically they would remember the parameters broadcast in the beacon of that AP before. So, if it had been broadcasting support for WPA3 only, the clients should only be trying WPA3 (if they still allow themselves to be tricked into connecting with WPA2, that's another downgrade attack based on that client issue, not related to WPA3 Transition Mode). May 30, 2020 at 6:44
  • However, despite this normal behavior of clients, now if we consider the case of WPA3 Transition Mode, support for both WPA3 and WPA2 would be broadcast by the genuine AP's beacon, so even normal clients who have stored these details, in the future, may try to connect with WPA2. So a rogue AP could get enough of the WPA2 4-way handshake to then mount a dictionary attack, without having prior knowledge of the PSK. May 30, 2020 at 6:46
  • Since WPA3 Transition Mode may be in common use for years, it becomes a non-trivial concern. May 30, 2020 at 6:48
  • 1
    @just_learning I am not aware of specific compromises related to these, although poor choice of ECP groups or MODP groups may be risky. Jun 5, 2022 at 16:12

1 Answer 1

0

Possible solution: Use WPA{2,3}-EAP instead?

You might want to use WPA{2,3}-EAP with EAP-TTLS, EAP-PEAPv2 or EAP-TEAP instead. This will provide:

  • per-user credentials (i.e. if you fire John, you can just revoke his account);
  • forward secrecy (assuming you are using a decent TLS ciphersuite);
  • access point authentication (using X.509 certificates) which is supposed to prevent trivial access point impersonation by clients who have the password.
2
  • Isn't using WPA (any flavour) going backwards, when it is already obsoleted by WPA2 and there now is WPA3? Apr 25 at 4:10
  • Yes, sorry. I was thinking of WPA2-EAP / WPA3-EAP.
    – ysdx
    Apr 25 at 8:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .