2.3 - Wireless Encryption

MIC

Message Integrity Check

Verifies that received data is identical to the original sent data (integrity check)

Wireless encryption purpose

All wireless devices are radio transmitters/receivers, so anyone can listen in; encrypting data ensures only those with the correct key can transmit and read it (WPA2, WPA3)

WEP (Wired Equivalent Privacy) 👎👎👎

Original wireless encryption with serious cryptographic weaknesses; deprecated — DO NOT use

WPA

Wi-Fi Protected Access

2002 replacement for WEP; a short-term bridge that used TKIP for encryption and ran on existing hardware

TKIP

Encryption protocol used in the original WPA; weaker than AES, later replaced

WPA2

Wi-Fi Protected Access II (certified 2004); replaced WPA; uses AES encryption (stronger than TKIP); often required an access point hardware upgrade because AES needs more CPU

AES

Advanced Encryption Standard

Strong encryption used by WPA2/WPA3; replaced the weaker TKIP; requires more CPU power

WPA3

Wi-Fi Protected Access 3 (2018); upgrade to WPA2 with stronger AES options, more secure initial key exchange, and encryption even on open networks

WEP vs. WPA vs. WPA2 vs. WPA3

• WEP = broken (don't use)

• WPA = TKIP (bridge)

• WPA2 = AES (2004)

• WPA3 = AES + better key exchange + open-network encryption (2018)

Open System

Wireless security mode requiring NO authentication password

WPA-Personal / WPA-PSK

WPA2 or WPA3 with a pre-shared key; everyone uses the same 256-bit key

WPA-Enterprise / WPA-802.1X

WPA2 or WPA3 that authenticates users individually against an authentication server (e.g., RADIUS)

Personal vs. Enterprise mode

• Personal (PSK) = one shared 256-bit key for everyone

• Enterprise (802.1X) = individual user authentication via an authentication server like RADIUS

RADIUS

Authentication server used in WPA-Enterprise / 802.1X mode to authenticate users individually