Wireless Security Fundamentals: WPA2, WPA3, and EAP

WPA3 replaces WPA2's vulnerable 4-way handshake with SAE for stronger pre-shared keys, while WPA-Enterprise uses 802.1X/EAP for individual user authentication.

WPA2 vs. WPA3

**WPA2** has been the standard for Wi-Fi security, utilizing AES encryption and CCMP. However, its 4-way handshake is vulnerable to offline dictionary attacks in PSK mode.

**WPA3** was introduced to solve these vulnerabilities. It replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), making offline dictionary attacks practically impossible and providing forward secrecy.

Personal vs. Enterprise Modes

Both WPA2 and WPA3 operate in two main modes:

* **Personal (PSK/SAE):** Uses a single shared password for all clients. Easy to deploy, but less secure and lacks individual accountability. * **Enterprise (802.1X):** Integrates with a RADIUS server. Each user logs in with unique credentials (username/password or certificates). It provides centralized management and dynamic VLAN assignment.

802.1X and EAP

In WPA-Enterprise networks, **802.1X** acts as the framework for access control, involving an Authenticator (the WLC/AP), a Supplicant (the client device), and an Authentication Server (RADIUS). The Extensible Authentication Protocol (EAP) is the protocol used to carry the authentication messages securely between the supplicant and the server.

❓ Frequently Asked Questions