Wireless Security and Authentication

You inherit a small office network. The Wi-Fi is using WPA2-PSK. Employees share one password. Someone leaves the company, and you realize you have no way to prevent them from connecting with that password. The password is also written on a sticky note in the break room.

That's the fundamental problem with pre-shared keys at scale — one leaked credential exposes the entire network. 802.1X (Enterprise mode) solves it by giving every user unique credentials backed by a RADIUS server. But first, understand the security spectrum from open to WPA3.

#The Security Progression#link

#WPA2-PSK and the Four-Way Handshake#link

The four-way handshake establishes encryption keys between client and AP without ever transmitting the password itself. Both sides derive a Pairwise Transient Key (PTK) from the PSK and the exchanged nonces. This is why a WPA2-PSK network doesn't broadcast the password — but also why an attacker who captures the handshake can brute-force the PSK offline.

#WPA3 Improvements#link

• ▪SAE (Simultaneous Authentication of Equals) — replaces PSK handshake, resistant to offline dictionary attacks
• ▪Forward secrecy — captured traffic can't be decrypted even if the password is later compromised
• ▪192-bit mode — optional stronger encryption for enterprise
• ▪Wi-Fi Enhanced Open (OWE) — encryption on open networks, protecting against passive sniffing
• ▪PMF (Protected Management Frames) — mandatory, prevents deauth attacks

SAE is the key change. In WPA2-PSK, an attacker captures a handshake and offline brute-forces the password at billions of guesses per second. In WPA3-SAe, each guess requires interacting with the live network — you can't brute-force offline. Dictionary attacks become orders of magnitude harder.

#PSK vs. 802.1X Enterprise#link

#Check Your Understanding#link