CCNA Wireless Security: WEP, WPA, WPA2, WPA3 & PSK vs Enterprise

Wired Equivalent Privacy (WEP) was the original 802.11 wireless security standard from 1997. WEP uses RC4 stream cipher with 40-bit or 104-bit keys. The fatal flaw: WEP reuses the same keystream, and the Initialization Vector (IV) is only 24 bits, leading to IV reuse that allows passive cryptanalysis. WEP can be cracked in minutes with freely available tools.

WEP should never be used. It is included in CCNA only as historical context and to understand why later standards were developed. If you see WEP as an answer option and the question is about 'secure' or 'recommended' — eliminate it immediately.

Wi-Fi Protected Access (WPA) was released in 2003 as an emergency replacement for WEP while 802.11i (WPA2) was being finalized. WPA uses TKIP (Temporal Key Integrity Protocol), which wraps RC4 with per-packet key mixing and a message integrity code (MIC, called 'Michael') to prevent the IV reuse attack.

WPA was designed to run on existing WEP hardware via firmware update. While significantly more secure than WEP, TKIP itself has known weaknesses (TKIP MIC failure attacks). WPA/TKIP is deprecated and should be replaced with WPA2 or WPA3.

WPA introduced the Personal (PSK) and Enterprise (802.1X) modes that carry through to WPA2 and WPA3.

WPA2 (802.11i) replaced WPA as the security standard in 2004. WPA2 uses CCMP (Counter Mode CBC-MAC Protocol) based on AES (Advanced Encryption Standard), a fundamentally stronger cipher than RC4. WPA2 is the minimum acceptable security standard for any current wireless deployment.

WPA2-Personal (WPA2-PSK) uses a Pre-Shared Key — a passphrase known to all users. The passphrase is used to derive the Pairwise Master Key (PMK). All clients use the same passphrase. Simple to deploy; weakness is that if the passphrase is compromised, all clients are affected, and there's no per-user identity.

WPA2-Enterprise uses 802.1X/EAP for authentication. Each user has individual credentials authenticated by a RADIUS server. Per-user PMK is derived dynamically per session — compromise of one user's session key doesn't affect others. Enterprise mode provides the identity-based access control needed for corporate networks.

WPA2 vulnerability: KRACK (Key Reinstallation Attack, 2017) demonstrated that WPA2 handshake could be manipulated. Mitigated by vendor patches. Also, weak PSK passphrases are vulnerable to offline dictionary attacks — use long, random passphrases.

WPA3 was released in 2018 to address WPA2 weaknesses. WPA3-Personal replaces PSK with SAE (Simultaneous Authentication of Equals), a protocol based on the Dragonfly handshake. SAE provides forward secrecy — even if an attacker records traffic and later obtains the passphrase, they cannot decrypt previously recorded sessions. SAE also resists offline dictionary attacks.

WPA3-Enterprise mandates 192-bit cryptographic strength (CNSA suite) for high-security environments. It uses stronger AES-256 (GCMP-256) and SHA-384 as the minimum cipher suite.

WPA3 Enhanced Open (OWE, Opportunistic Wireless Encryption) encrypts open network traffic without requiring a password. This protects users on public Wi-Fi from passive eavesdropping even on networks with no password — previously, open networks transmitted all traffic in plaintext.

WPA3 transition mode allows WPA3 and WPA2 devices to coexist on the same SSID during migration. For CCNA: know the key improvements — SAE replaces PSK, forward secrecy, stronger mandatory ciphers.

Open authentication (no security): no credentials required. Any device can join. Appropriate only for captive portal environments where a different mechanism handles access control. Never acceptable for corporate networks.

WPA2/3-Personal (PSK/SAE): passphrase authentication. All devices use the same credential. Easy to manage for small environments; doesn't scale because you can't revoke access for one user without changing the passphrase for everyone.

WPA2/3-Enterprise (802.1X/EAP): individual user credentials. Integrates with corporate identity systems (Active Directory via RADIUS). Users can be individually authenticated, authorized, and revoked. Required for compliance-driven environments (PCI-DSS, HIPAA).