Wireless Security Protocols

In the previous lesson, you learned that wireless security relies on three core principles: authentication, encryption, and integrity. These principles define what must be protected, but they do not explain how protection is implemented on a Wireless network.

We will now look at the various wireless security protocols that implement these protections on Wi-Fi networks.
They define how a wireless client authenticates, how data is protected, and how integrity is ensured.

Open Authentication

Open Authentication is the simplest possible authentication method.
It provides no built-in security.

As shown in Figure 1, the client sends an authentication request to the access point, and the access point accepts all authentication requests without verifying any credentials.

Figure 1 - Open authentication

In this model:

• No password is required

• Any client can authenticate

• The access point does not verify the identity of the client

This type of authentication is commonly found in public Wi-Fi networks such as airports, cafés, or hotels.

⚠️ Important:
Because Open Authentication does not verify client identity and provides no encryption or integrity protection, the wireless network itself is not secure.

From Open Authentication to Shared Secrets

Because Open Authentication provides no real security, additional mechanisms are required to protect wireless networks.

At a high level, wireless authentication mechanisms can be grouped into two categories:

• Open Authentication

• Authentication based on a shared secret

Figure 2 - Wireless authentication methods

Figure 2 summarizes this evolution, showing how wireless security protocols have changed over time.

Shared Key–Based Security

Shared key–based security requires the client and the access point to share a secret.
This shared secret is used as the basis for authenticating clients and protecting wireless traffic.

All major wireless security protocols rely on shared secrets in some form:

• WEP

• WPA

• WPA2

• WPA3

Each new protocol improves how the shared secret is used, how encryption is performed, and how integrity is ensured.
Let’s start with WEP, the first wireless security protocol to implement a shared secret.

Wired Equivalent Privacy (WEP) was the first wireless security protocol defined by the IEEE 802.11 standard. It was introduced in 1997 with the goal of providing a level of security for wireless networks comparable to wired networks.

The design of WEP was based on a shared secret key configured on both the client and the access point.
This key was used for authentication, encryption, and integrity protection.

WEP Process

To understand WEP, let's look at a practical example: you are the PC attempting to authenticate to a WEP-protected wireless network.

Authentication

1. You send an Authentication Request to the access point.

2. The access point replies with a challenge, which is a random value sent in plaintext.

3. You encrypt this challenge using the shared WEP key and the RC4 algorithm.

4. You send the encrypted challenge back to the access point.

5. The access point decrypts the response using its own copy of the shared key.

6. If the decrypted value matches the original challenge, the access point sends an Authentication Response (Success).

Figure 3 - WEP

The purpose of the challenge is to verify that both you and the access point possess the same shared secret key, without transmitting the key itself over the air.

Association

After successful authentication:

1. You send an Association Request to the access point.

2. The access point replies with an Association Response, allowing your device to join the wireless network.

Encrypted Data Transmission

Once association is complete:

1. All wireless traffic is encrypted using the RC4 stream cipher.

2. CRC (Cyclic Redundancy Check) is used to verify data integrity.

3. CRC is not a secure integrity mechanism and does not protect against intentional data modification.

WEP Characteristics

At first glance, WEP appears to be a complete wireless security protocol because it includes mechanisms for authentication, encryption, and integrity.

• Authentication: Open System, Shared Key

• Encryption: RC4

• Integrity: CRC

However, WEP is an old protocol. Over time, attackers discovered multiple security weaknesses in its design, including flaws in key management, encryption implementation, and integrity checking.

These vulnerabilities made WEP easy to break and unsuitable for modern wireless networks. As a result, the industry had to improve wireless security standards.

In the next section, we will see how WPA was introduced to address these weaknesses and enhance wireless security.

Wi-Fi Protected Access (WPA) was introduced in 2003 by the Wi-Fi Alliance as an interim solution to fix the most critical security weaknesses of WEP, while remaining compatible with existing hardware.

Instead of redesigning everything from scratch, WPA kept the shared key concept but significantly improved key management and integrity protection.

WPA introduced two operating modes that are still used today:

• WPA Personal — for home and small networks

• WPA Enterprise — for enterprise environments using centralized authentication

WPA Personal

WPA Personal is designed for home users and small offices.
It relies on a Pre-Shared Key (PSK) configured on both the client and the access point.

WPA Personal Process

When you connect your PC to a WPA-Personal wireless network:

• The client and the access point use the pre-shared key (PSK) to verify that they both know the same secret.

• If this verification is successful, authentication succeeds.

• The client and access point complete the association process.

• All wireless traffic is then encrypted.

Figure 4 – WPA Personal

Encrypted Data Transmission

Once the association process is complete:

1. All wireless traffic is encrypted using TKIP (Temporal Key Integrity Protocol).

2. TKIP modifies the encryption key for each packet to prevent key reuse.

3. MIC (Message Integrity Check) is used to protect data integrity and detect packet tampering.

WPA Enterprise (802.1X)

WPA Enterprise is designed for professional and enterprise environments where a simple shared password is not sufficient.

Instead of using a single pre-shared key for all users, WPA Enterprise relies on 802.1X authentication and a RADIUS server to authenticate each user individually.

WPA Enterprise Process

As shown in Figure 5, three components are involved:

• You (the client / supplicant)

• The access point or wireless controller (authenticator)

• The RADIUS server (authentication server)

Figure 5 – WPA Enterprise authentication

When you connect to a WPA Enterprise wireless network:

1. You initiate an 802.1X authentication with the access point.

2. The access point forwards your authentication information to the RADIUS server using EAP (Extensible Authentication Protocol).

3. The RADIUS server validates your credentials.

4. If authentication is successful, the RADIUS server sends an Access-Accept message.

5. The access point informs you that authentication has succeeded.

6. You and the access point complete the association process.

7. All wireless traffic is then encrypted.

The key point is that the access point does not authenticate you directly.
It acts as an intermediary and relies on the RADIUS server to make the authentication decision.

WPA Characteristics

WPA represents a significant improvement over WEP by strengthening key management and integrity protection, while maintaining compatibility with older wireless hardware.

• Authentication:
  WPA supports two authentication modes:

  • PSK (Personal) for home and small networks

  • 802.1X (Enterprise) for centralized, per-user authentication
    

• Encryption:
  WPA uses TKIP (Temporal Key Integrity Protocol).
  TKIP is based on RC4 but introduces dynamic per-packet key generation, which prevents key reuse.
  
  

• Integrity:
  WPA replaces CRC with MIC (Message Integrity Check), providing improved protection against packet tampering and replay attacks.

Although WPA is much more secure than WEP, it still relies on RC4, which is now considered a legacy encryption algorithm.
For this reason, WPA is considered a transitional standard and was later replaced by WPA2.

After WPA, the next major step in wireless security evolution is WPA2.

WPA2 was introduced in 2004 and quickly became the industry standard for securing Wi-Fi networks.
Its goal was not to change how clients authenticate, but to fix the remaining cryptographic weaknesses of WPA.

The authentication models remain the same:

• Personal mode using a pre-shared key (PSK)

• Enterprise mode using 802.1X and a RADIUS server

The improvement introduced by WPA2 is mainly about encryption and integrity.

WPA2 Personal

The connection flow is the same as WPA Personal: the client and the access point verify that they both know the same pre-shared key, associate with the access point, and then exchange encrypted data.

Figure 6 – WPA2 Personal

WPA2 replaces TKIP with AES for encryption, using a 128-bit key, and CCMP for integrity and replay protection.

WPA2 Enterprise

In WPA2 Enterprise, the authentication mechanism remains the same as WPA Enterprise.
Authentication is still performed using 802.1X and a RADIUS server.

Figure 7 – WPA2 Enterprise authentication

After authentication, the traffic is encrypted using AES. CCMP then provides integrity and replay protection.

Why WPA3 Was Introduced

However, even though WPA2 significantly improved wireless security, some limitations remained.
In particular, WPA2 still relies on pre-shared keys in Personal mode and is vulnerable to certain offline password attacks.

To address these remaining weaknesses, a new generation of wireless security was introduced: WPA3.

WPA3 is the modern standard for wireless security.
It was introduced to fix the remaining security weaknesses of WPA2 and to provide stronger protection for wireless networks.

WPA3 Personal

WPA3 Personal introduces a new authentication method called SAE (Simultaneous Authentication of Equals).

In WPA3 Personal, the client and the access point authenticate using SAE instead of a traditional pre-shared key (PSK).
SAE was introduced because WPA2 Personal is vulnerable to offline dictionary attacks.

Figure 8 - WPA3 Personal

With SAE, each authentication attempt is unique.
This prevents an attacker from capturing traffic and testing passwords offline.

After successful SAE authentication, the client and the access point complete the association process, and all wireless traffic is encrypted using AES, with GCMP providing integrity.

WPA3 Enterprise

WPA3 Enterprise functions similarly to WPA2 Enterprise but introduces an optional 192-bit security mode for high-security environments.

Figure 9 - WPA3 Enterprise

After successful authentication and association, all wireless traffic is encrypted using AES.

WPA3 Characteristics

At first glance, WPA3 appears to be the most complete wireless security protocol so far.
It improves authentication, encryption, and integrity to address the remaining weaknesses of WPA2.

• Authentication:

  • SAE (Personal)

  • 802.1X (Enterprise)
    

• Encryption:

  • AES
    

• Integrity:

  • GCMP
    

• Key / Crypto Strength:

  • 128-bit (Personal)

  • 192-bit (Enterprise)

WPA3 significantly strengthens wireless security by preventing offline dictionary attacks in Personal mode and offering higher cryptographic strength in Enterprise environments.

To recap everything we have seen so far, multiple wireless security protocols are used in networking.
For the CCNA exam, you must know the authentication, encryption, integrity, and key lengths used by each protocol.

Wireless Security Protocols Summary

Table 1 - Wireless Security Protocol Summary

Over time, wireless security protocols have continuously evolved to address newly discovered vulnerabilities.
As attackers find new ways to break existing standards, wireless security continues to improve.

You may encounter newer wireless security protocols in the future, but the concepts covered here form the foundation you must master for the CCNA.