WPA (Wi-Fi Protected Access) is a Wi-Fi Alliance security certification program for protecting wireless LAN communications. It addresses authentication, confidentiality, and integrity across wireless networks, where transmissions can be received beyond the intended participants. section 20.0
WPA defines two principal authentication models:
- WPA-Personal uses a pre-shared key (PSK), typically configured as an 8- to 63-character passphrase that is converted into a 256-bit PSK. The access point and clients must share the same key. section 20.2 section 20.5
- WPA-Enterprise uses 802.1X and EAP with individual user or device credentials instead of one shared PSK, making it suitable for larger business networks. section 20.2 section 20.5
In WPA-Personal, the client performs Open System Authentication and associates with the access point before completing a four-way handshake. The handshake verifies possession of the PSK and generates encryption keys. WPA and WPA2 PSK authentication can be brute-forced from a captured handshake; WPA3 replaces that authentication step with SAE before association, then retains the four-way handshake. section 20.5
The WPA generations align with progressively stronger protocol combinations:
- WPA uses RC4 with TKIP and a message integrity code (MIC). section 20.4
- WPA2 uses AES with CCMP and CBC-MAC; it can optionally retain TKIP for older clients. section 20.4
- WPA3 uses AES with GCMP and GMAC, supports CCMP, mandates Protected Management Frames, and provides forward secrecy for session data when a PSK is later compromised. section 20.4
Personal-network authentication flow
A client configured with the network's passphrase authenticates through WPA-Personal, associates with the access point, and completes the four-way handshake. With WPA3, SAE occurs before association to reduce captured-handshake brute-force risk, although a single passphrase can still be exposed through social engineering. section 20.5
Table 20.1 WPA security protocols (view table figure)
| WEP |
WPA |
WPA2 |
WPA3 |
|
|---|---|---|---|---|
| Release Year |
1997 |
2003 |
2004 |
2018 |
| Authentication (WPA-Personal) |
Open System, Shared key |
PSK |
PSK |
SAE |
| Authentication (WPA-Enterprise) |
N/A |
802.1X/EAP |
802.1X/EAP |
802.1X/EAP |
| Encryption |
RC4 |
RC4 (TKIP) |
AES (CCMP) |
AES (GCMP) |
| Integrity |
ICV |
MIC (TKIP) |
CBC-MAC (CCMP) |
GMAC (GCMP) |
Compare WPA generations by release year, authentication, encryption, and integrity mechanisms. section 20.4
