The evolution of wireless networking is not unlike the evolution of computers throughout the last couple of decades. Wireless networks authentication model first relied on Wired Equivalent Protection (WEP). WEP had many shortcomings and was quickly, and easily exploited. This forced a transition from WEP to Wireless Protected Access (WPA).
WPA proved insufficient due to only using Temporal Key Integrity Protocol (TKIP) which, although better than WEP, was still exploitable. This vulnerability was addressed in WPA2 by integration of the Advanced Encryption Standard (AES) which was established by the National Institute of Standards and Technology (NIST). To add to AES’ credibility, it was adopted by the U.S. federal government as an encryption standard. WPA2 provided security mechanisms for both individuals and integration into enterprise authentication servers. However, in 2017 researchers discovered the Key Reinstallation Attack, also known as KRACK. Vanhoef and Piessens (n.d.) shared that this is achieved by the manipulation and replay of cryptographic keys during the 4-way handshake, essentially leaving all modern wireless routers vulnerable.
Enter WPA3 and additional security features to better protect wireless networks from both poor configuration and intentional cyber attacks. According to Wi-Fi Alliance (n.d.), WPA3 provides advanced security features such as Simultaneous Authentication of Equals (SAE) which replaces Pre-Shared Keys (PSK) and also provides additional defense against dictionary attacks if the WPA3-Personal password is weaker than it should be. Further, Wi-Fi Alliance (n.d.) stated that the WPA3-Enterprise mode provided an enhancement of 192-bit cryptographic strength. The additions of these features provide network administrators to bolster their current wireless networks and posture them for better defending against modern cyber attacks.
Concluding this post, we can see how the security protocols evolved over the lifecycle of wireless technology. These changes resulted from exposed vulnerabilities and changes to technology which made such attacks a possibility. WPA3 is the next iteration in the effort to provide network administrators with the necessary tools to protect their wireless networks and prevent them from becoming an easy infiltration point.