WPA-Personal authenticates wireless clients with a pre-shared key (PSK), making it primarily suitable for SOHO networks. The same PSK is configured on the access point and every client in the BSS. A practical passphrase of 8–63 characters is converted automatically into a static 256-bit PSK. section 20.2 section 20.2.1
WPA-Personal authentication proceeds as follows:
- The client performs 802.11 Open System Authentication and associates with the access point. section 20.2.1
- A four-way handshake confirms that the client and access point possess matching PSKs. section 20.2.1
- The handshake generates unique encryption keys for data exchanged with that client. section 20.2.1
- WPA and WPA2 PSK authentication can be attacked by brute force if an attacker captures the four-way handshake. section 20.2.1
WPA3-Personal retains a PSK but replaces the earlier authentication exchange with Simultaneous Authentication of Equals (SAE). SAE occurs before association, verifies matching PSKs without exposing them to the same handshake-based brute-force attack, and is followed by the four-way handshake. section 20.2.1 section 20.5
SOHO configuration
Configure one passphrase on the access point and all participating clients, such as an 8–63-character Wi-Fi password. The devices use the resulting shared PSK during the four-way handshake; WPA3-Personal additionally performs SAE before association. section 20.2.1
Figure 20.4 WPA-Personal authentication with a PSK. After the client associates with the AP, a four-way handshake is used to confirm that both have the same PSK and to generate unique encryption keys.
Visualizes association followed by the four-way handshake, including PSK verification and encryption-key generation. section 20.2.1
Figure 20.5 WPA3-Personal authentication using SAE. SAE authentication allows the client and AP to confirm they have the same PSK and derive a key used in the four-way handshake. In the four-way handshake, they generate the encryption keys used to encrypt/decrypt data messages.
Visualizes WPA3-Personal SAE before association and the subsequent four-way handshake that generates data-encryption keys. section 20.2.1
