Simultaneous Authentication of Equals (SAE) is WPA3-Personal’s password-authentication method. It lets a wireless client and access point confirm matching PSKs without exposing the PSK to the brute-force attack enabled by capturing a WPA/WPA2 four-way handshake. section 20.2 section 20.2.1
Follow the WPA3-Personal authentication sequence and its operational boundaries:
- The user still enters an 8- to 63-character passphrase; that passphrase produces the PSK used by the client and AP. section 20.2.1 section 20.5
- SAE runs before 802.11 association, allowing both sides to verify matching PSKs and derive a key for the four-way handshake. section 20.2.1 section 20.5
- The subsequent four-way handshake generates the encryption keys used to encrypt and decrypt wireless data. section 20.2.1
- SAE reduces practical brute-force risk from captured authentication traffic but does not prevent compromise of the shared passphrase through social engineering. section 20.2.1
Figure 20.5 WPA3-Personal authentication using SAE. SAE authentication allows the client and AP to confirm they have the same PSK and derive a key used in the four-way handshake. In the four-way handshake, they generate the encryption keys used to encrypt/decrypt data messages.
The WPA3-Personal flow diagram distinguishes SAE’s PSK verification and key derivation from the four-way handshake’s data-encryption-key generation. section 20.2.1
