- Security: Set to WPA3 Personal for better security, or set to WPA2/WPA3 Transitional for compatibility with older devices.
- Network name (SSID): Set to a single, unique name (case-sensitive) for all bands.
- Hidden network: Set to Disabled.
- MAC address filtering, authentication, or access control: Set to Disabled.
- Automatic firmware updates: Set to Enabled.
- Radio mode: Set to All (preferred), or set to Wi-Fi 2 through Wi-Fi 6 or later.
- Bands: Enable all bands supported by your router.
- Channel: Set to Auto.
- Channel width: Set to 20 MHz for the 2.4 GHz band. Set to Auto or all widths for the 5 GHz and 6 GHz bands.
- DHCP: Set to Enabled if your router is the only DHCP server on the network.
- DHCP lease time: Set to 8 hours for home or office networks. Set to 1 hour for hotspots or guest networks.
- NAT: Set to Enabled if your router is the only device providing NAT on the network.
- WMM: Set to Enabled.
- DNS server: Continue using the default DNS server, or specify a different primary or secondary server.
Source: https://support.apple.com/en-us/102766
WPA3 support
WPA3 is supported on the following Apple devices:
- iPhone 7 or later
- iPad 5th generation or later
- Apple TV 4K or later
- Apple Watch series 3 or later
- Mac computers (late 2013 or later, with 802.11ac or later)
Newer devices support authentication with WPA3 Enterprise 192-bit security, which includes support for 256-bit AES encryption when connecting to compatible wireless access points (APs). This encryption provides even stronger confidentiality protections for traffic sent over the air. WPA3 Enterprise 192-bit security is supported in all iPhone 11 models or later, all iPad models starting with the iPad 7th generation, and all Mac computers with Apple silicon.
Source: https://support.apple.com/guide/security/secure-access-to-wireless-networks-sec8a67fa93d/web
WPA2 vs WPA3: Key Difference in Wi-Fi Security Protocols
Source: https://io.hfcl.com/blog/wpa2-vs-wpa3/
In Wi-Fi security, the journey from Wired Equivalent Privacy (WEP) to the present-day encryption standards has been marked by a series of crucial advancements and challenges. Initially deployed in 802.11b networks, WEP’s vulnerabilities prompted Wi-Fi Alliance to develop the Wi-Fi Protected Access (WPA) specification and its subsequent refinement in the form of WPA2 in 2004.
WPA2, with its use of the Advanced Encryption Standard (AES) and more robust handshake protocols, became the industry standard, offering a strong defense against cyber threats. But, it also faced challenges like the WPA2 KRACK attack.
The evolution of Wi-Fi security took a transformative turn with the advent of WPA3 in June 2018, offering both WPA3-Personal (primarily for homes and small offices) and WPA3-Enterprise (for enterprise/corporate networks) versions. The shift from WPA2 to WPA3 signifies more than just an incremental upgrade; it represents a paradigm shift in Wi-Fi security.
While retaining the 128-bit AES encryption of WPA2, the enterprise version of WPA3 mandates 192-bit AES support, an optional feature for the personal edition. Well this is just a beginning and there is a lot more that sets WPA3 apart from WPA2. To name a few individualized data encryption, Simultaneous Authentication of Equals protocol, and stronger brute force attack protection is what makes WPA3 better than WPA2. WPA3 also mandates the use of Protected Management Frames (PMF), a departure from its optional status in WPA2.
One by one let’s decode how these Wi-Fi security protocols have been upgraded to provide the ultimate level of Wi-Fi security ensuring safe and secure use of Wi-Fi.
What is WPA2?
WPA2 is a protocol designed to secure wireless networks. Introduced in 2004 as an upgrade to the original WPA , WPA2 has become the standard for Wi-Fi security. WPA2 uses the Advanced Encryption Standard (AES) with a 128-bit key for encrypting data transmitted over wireless networks, providing a high level of security.
One of the most prominent aspects of WPA2 is the use of the four-way handshake process for authentication. This process ensures that only authorized devices can connect to the network. WPA2 comes in two variants: WPA2-Personal, which is meant for homes and small offices, uses a pre-shared key (PSK) for authentication. WPA2-Enterprise, which relies on a RADIUS server for authentication, is suitable for larger organizations.
Despite its strengths, WPA2 has some well-known vulnerabilities. One of the most significant is its susceptibility to offline dictionary attacks, particularly when weak passwords are used. Attackers can capture the four-way handshake and attempt to crack the PSK offline. Additionally, WPA2 is vulnerable to key reinstallation attacks (KRACKs), which can allow attackers to decrypt and manipulate data transmitted over the network.
To address these vulnerabilities, the Wi-Fi Alliance introduced WPA3 in 2018. WPA3 offers several improvements over WPA2, including stronger encryption, protection against offline dictionary attacks, and enhanced security for public networks. However, WPA2 remains widely used and is still considered secure when implemented with strong passwords and regular security updates.
What is WPA3?
WPA3 (Wi-Fi Protected Access 3) is the latest wireless security protocol introduced by the Wi-Fi Alliance in 2018. As the successor to the widely-used WPA2 protocol, WPA3 aims to further enhance Wi-Fi security and address vulnerabilities discovered in its predecessor. WPA3 introduces significant advancements in encryption, authentication, and overall network protection.
One of the key features of WPA3 is its improved encryption mechanism. While WPA2 uses the AES (Advanced Encryption Standard) for data encryption, WPA3 takes it a step further by introducing the Simultaneous Authentication of Equals (SAE) algorithm, also known as Dragonfly. SAE provides stronger protection against offline dictionary attacks and enhances the security of the password-based authentication process.
Moreover, WPA3 introduces forward secrecy, ensuring that even if an attacker manages to obtain a user’s password, they cannot decrypt previously captured data. This feature is particularly beneficial in safeguarding sensitive information transmitted over Wi-Fi networks.
WPA3-Personal, designed for home and small office networks, simplifies the process of setting up secure Wi-Fi connections and eliminates the vulnerabilities associated with weak passwords. On the other hand, WPA3-Enterprise, targeted at businesses and organizations, provides additional security features such as 192-bit encryption and enhanced protection against side-channel attacks.
To take advantage of WPA3 security, users need to have WPA3-compatible Wi-Fi routers and devices. As WPA3 gains wider adoption, it is expected to become the new standard for wireless security, offering individuals and businesses a more robust and secure Wi-Fi experience. Note that routers which are WPA3-compatible typically also support WPA2/WPA, thus enabling legacy non-WPA3 clients to connect to the network (using a different SSID).
Difference between WPA2 and WPA3
The below table highlights the key differences between WPA2 and WPA3 in terms of encryption, authentication, security features, compatibility, and adoption.
Features WPA2 vs WPA3
- Encryption
- AES with 128-bit key
- Supports 192-bit encryption
- Key Establishment
- 4-way handshake
- Dragonfly handshake
- Authentication
- Pre-Shared Key (PSK)
- Simultaneous Authentication of Equals (SAE)
- Password Security
- Vulnerable to offline dictionary attacks
- Resistant to offline dictionary attacks
- Forward Secrecy
- Not supported
- Provided, preventing decryption of previously captured data
- Side-Channel Protection
- Not supported
- Included, protecting against cache-based attacks
- Compatibility
- Widely supported by most devices
- Newer devices are more likely to support WPA3
- Transition Mode
- Has a Transition Mode with respect to WPA
- Has a Transition Mode with respect to WPA2
- Adoption
- Widely adopted and currently the most common standard
- Gradually being adopted by manufacturers and expected to become the new standard
WPA2 Personal vs WPA3 Personal
Here are the main differences between WPA2-Personal and WPA3-Personal:
Security
WPA2-Personal: Uses the TKIP (Temporal Key Integrity Protocol) or AES (Advanced Encryption Standard) encryption. It is vulnerable to offline dictionary attacks if a weak passphrase is used.
WPA3-Personal: Uses the more secure SAE (Simultaneous Authentication of Equals), also known as Dragonfly handshake. It provides better protection against offline dictionary attacks, even if a weak passphrase is used.
Key Exchange
WPA2-Personal: Uses the 4-way handshake process for key exchange, which is vulnerable to key reinstallation attacks (KRACK).
WPA3-Personal: Uses a more secure key exchange mechanism called Simultaneous Authentication of Equals (SAE), which is resistant to KRACK attacks.
Password Protection
WPA2-Personal: Does not provide additional protection for weak passwords.
WPA3-Personal: Provides better protection, even if a weak passphrase is used. This is done by using a more secure key exchange mechanism that makes it harder for the attackers to crack the password.
Backward Compatibility
WPA2-Personal: Widely compatible with older devices and can work with a mix of WPA2 and WPA3 devices. WPA3-Personal: Offers a “transitional mode” that allows mixed networks of WPA2 and WPA3 devices, ensuring backward compatibility.
WPA2 Enterprise vs WPA3 Enterprise
Here are the main differences between WPA2-Enterprise and WPA3-Enterprise:
Security
WPA2-Enterprise: Uses the AES (Advanced Encryption Standard) encryption for secure communication. It is generally considered secure but has some known vulnerabilities.
WPA3-Enterprise: Introduces several security enhancements, including stronger encryption algorithms and improved key management. It addresses vulnerabilities found in WPA2 and provides better protection against various types of attacks.
Encryption
WPA2-Enterprise: Uses a minimum of 128-bit Advanced Encryption Standard Counter Mode with Cipher Block Chaining Message Authentication (AES-CCMP 128).
WPA3-Enterprise: Offers two modes:
- Standard mode: Uses a minimum of 128-bit AES-CCMP encryption.
- 192-bit mode: Uses 256-bit Galois/Counter Mode Protocol (GCMP-256) for stronger encryption.
Authentication Methods
WPA2-Enterprise: Supports various Extensible Authentication Protocol (EAP) methods for authentication, such as EAP-TLS, EAP-TTLS, PEAP, and others.
WPA3-Enterprise: Continues to support multiple EAP methods.
WPA3-Enterprise 192-bit mode: Specifically requires the use of EAP-TLS with Elliptic Curve Diffie-Hellman (ECDH) exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) using a 384-bit elliptic curve for authentication.
Deployment and Compatibility
WPA2-Enterprise: Widely deployed and supported by most enterprise-grade wireless devices and infrastructure.
WPA3-Enterprise: Newer protocol and may require updated hardware and software to support its features. It is gradually being adopted in enterprise environments.
Backward Compatibility
WPA2-Personal: Widely compatible with older devices and can work with a mix of WPA2 and WPA3 devices. WPA3-Personal: Offers a “transitional mode” that allows mixed networks of WPA2 and WPA3 devices, ensuring backward compatibility.
The Role of Protocols in Wireless Network Security
Protocols play a crucial role in enhancing wireless network security by providing a structured framework for data encryption, integrity checks, and secure authentication mechanisms. These sets of rules and standards govern the secure transmission of data across Wi-Fi networks, ensuring confidentiality and protection against unauthorized access.
WPA2 Protocols & Security
- Advanced Encryption Standard (AES):
- AES is a robust encryption algorithm employed for encrypting data transmitted over the network.
- It offers significantly higher security compared to the Temporal Key Integrity Protocol (TKIP) used in WPA.
- Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP):
- CCMP replaces TKIP as the encryption protocol in WPA2.
- It provides strong data protection and integrity by applying AES in a more secure mode. 802.1X Authentication:
- 802.1X authentication offers a robust framework for authenticating and managing users on enterprise networks.
- It utilizes an authentication server to verify user credentials, enhancing security.
WPA3 Protocols & Security
- Simultaneous Authentication of Equals (SAE):
- SAE introduces a more secure initial key exchange process compared to WPA2’s Pre-Shared Key (PSK).
- It significantly enhances protection against offline dictionary attacks, strengthening network security.
- 192-bit Encryption Standard:
- In WPA3-Enterprise mode, a higher level of security is provided, conforming to the Commercial National Security Algorithm (CNSA) suite.
- This elevated encryption standard safeguards sensitive data in government and financial sectors.
- Forward Secrecy:
- Forward secrecy ensures that current session keys cannot be used to decrypt past sessions, even if they are compromised.
- This additional layer of security prevents the exposure of previously transmitted data.
The incorporation of these advanced protocols and security measures in WPA2 and WPA3 significantly enhances the overall security posture of wireless networks.
Conclusion
The transition from WPA2 to WPA3 marks a significant advancement in Wi-Fi security. WPA3 addresses the vulnerabilities and deficiencies of WPA2, such as offline dictionary attacks and lack of forward secrecy, by introducing more robust encryption and authentication mechanisms like 192-bit security and SAE .
The evolution of Wi-Fi security standards, exemplified by the introduction of WPA3, is crucial in keeping pace with the ever-changing landscape of cyber threats.
TL;DR
What are the key differences between WPA2 and WPA3?
The main differences are: WPA3 uses stronger encryption (192-bit AES) and the SAE handshake, making it more secure against dictionary attacks. WPA3 also provides forward secrecy and protects against side-channel attacks, which WPA2 lacks.
Is WPA3 backward compatible with WPA2 devices?
Yes, WPA3 has a transitional mode that allows a mixed network with both WPA2 and WPA3 devices. However, the WPA2 devices will only get the security level of WPA2, not the enhanced protection of WPA3.
Do I need to replace my router to use WPA3?
Most likely, yes. To take full advantage of WPA3, you’ll need a router and devices that support the WPA3 protocol. Older routers and devices may not be compatible with WPA3 and would need to be replaced.
How can I check if my devices support WPA3?
You can check the specifications of your router, smartphone, laptop, or other devices to see if they are listed as WPA3-certified or WPA3-compatible. Newer devices released after 2019-2020 are more likely to support WPA3.
Is WPA2 still secure if I use a strong password?
While using a strong, random password helps mitigate some of WPA2’s vulnerabilities, WPA3 is still more secure overall. WPA2 remains susceptible to certain attacks like KRACK that WPA3 addresses. However, WPA2 with a strong password is better than using obsolete protocols like WEP.