# Wireless Network Security (WPA3)
WPA3 (Wi-Fi Protected Access 3) is the current generation wireless security protocol ratified by the Wi-Fi Alliance in 2018, designed to address structural weaknesses in WPA2 that had accumulated over fifteen years of deployment. It replaces the Pre-Shared Key handshake mechanism with a cryptographically stronger mutual authentication protocol, mandates encrypted management frames, and extends encryption protections to open public networks.
WPA3 exists because WPA2's KRACK vulnerability (2017), PMKID attack exposure (2018), and susceptibility to offline password-cracking made it inadequate for environments requiring genuine confidentiality. Organizations running wireless infrastructure without WPA3 are operating on a protocol whose fundamental authentication mechanism can be broken by any attacker who captures the four-way handshake and runs a dictionary attack at their leisure, without any further network presence required.
WPA3 is a wireless security certification standard developed and maintained by the Wi-Fi Alliance, building on the IEEE 802.11i specification that underpins both WPA2 and WPA3. It defines authentication, key negotiation, and encryption requirements for wireless network equipment. WPA3 ships in two primary configurations: WPA3-Personal, intended for home and small-business networks, and WPA3-Enterprise, designed for corporate, government, and regulated-industry environments.
WPA3-Personal replaces WPA2's Pre-Shared Key (PSK) mode with Simultaneous Authentication of Equals (SAE), a password-authenticated key agreement protocol derived from the Dragonfly handshake (RFC 7664). WPA3-Enterprise introduces a mandatory 192-bit minimum security mode using algorithms from the Commercial National Security Algorithm (CNSA) suite, including ECDHE with P-384 and AES-256-GCM.
WPA3 is not a firewall, an intrusion detection system, or a network segmentation tool. It governs only the authentication and encryption of the wireless link between a client device and an access point. Threats that occur after a client has successfully authenticated, such as lateral movement across a flat network, man-in-the-middle attacks at the application layer, or rogue access points using social engineering, are outside WPA3's scope entirely.
---
Under WPA2-Personal, authentication begins with a four-way handshake that exposes the Pairwise Master Key Identifier (PMKID) and the handshake frames needed to mount an offline dictionary attack. An attacker captures this exchange passively, walks away, and attempts billions of password guesses per second against a GPU cluster. No further network presence is required. This is not a theoretical concern; tools such as hashcat with the appropriate hash mode have made this process accessible to low-skill attackers for years.
WPA3-Personal replaces this with SAE. The SAE process works as follows:
First, the client and access point each generate a temporary scalar and element value derived from the password and their MAC addresses using a process called hunting-and-pecking (or the more recent and resistant hash-to-curve method specified in later SAE variants). The two parties exchange these commit frames. Each party can verify the other knows the password without ever transmitting the password or a static hash of it.
A confirm exchange follows, producing a Pairwise Master Key (PMK) that is unique to that session. Because the PMK is derived fresh for every authentication event, capturing the exchange and cracking it offline is not possible. Each authentication requires active interaction with the access point, so brute-force attempts are rate-limited and observable.
Forward secrecy is a direct consequence of this design. If an attacker records encrypted Wi-Fi traffic and later discovers the network password, that knowledge does not decrypt previously recorded sessions. Each session key is independently derived.
Under WPA2, deauthentication and disassociation frames were unauthenticated. Any device could forge a deauthentication frame, evict any client from the network, and force a reconnection. This was the mechanism behind WPA2 downgrade attacks and was widely used in denial-of-service toolkits. WPA3 makes PMF mandatory, cryptographically binding management frames to the session so forged frames are rejected.
For organizations in regulated industries, WPA3-Enterprise's 192-bit security mode mandates: ECDHE using P-384 for key exchange, AES-256-GCM for data encryption, SHA-384 for integrity, and ECDSA with P-384 or RSA-3072 for certificates. This alignment with NSA Suite B and CNSA makes WPA3-Enterprise suitable for environments handling controlled unclassified information (CUI) or classified networks where wireless infrastructure is permitted.
The 192-bit mode is not merely WPA2 with stronger algorithms. It represents a complete configuration baseline where every cryptographic primitive meets specific strength requirements. Certificate authorities must use SHA-384 or higher for signatures. RADIUS server certificates must use either ECDSA with P-384 curves or RSA with minimum 3072-bit keys. The entire authentication chain operates at consistent strength levels, eliminating the common scenario where AES-256 encryption protects data secured by a weak certificate signed with SHA-1.
OWE performs a Diffie-Hellman key exchange during the open authentication process. Each client session receives a unique encryption key, so an observer monitoring the air cannot reconstruct session traffic even for open networks. A passive attacker sitting in the same coffee shop can no longer read unencrypted HTTP traffic or capture application-layer credentials from users who have not noticed that a site does not use HTTPS.
OWE does not authenticate the network. A client cannot verify that the "Airport_WiFi" network advertising OWE is actually operated by the airport rather than an attacker with a portable access point. OWE prevents passive eavesdropping but does not solve the evil twin problem.
When an access point operates in WPA3-Transition mode, it advertises both WPA2 and WPA3 capabilities. An attacker can set up a rogue access point advertising only WPA2 with identical SSID credentials, forcing WPA3-capable clients to fall back to WPA2. This is a practical downgrade attack that restores all the vulnerabilities that WPA3 was designed to eliminate.
Transition mode is acceptable for a defined migration window, not as a permanent configuration. Organizations should plan migration timelines that phase out WPA2 support entirely rather than running transition mode indefinitely. The attack is not theoretical; it requires only a portable access point and knowledge of the network name and password.
A pharmaceutical manufacturing facility replaced WPA2-Enterprise with WPA3-Enterprise 192-bit mode across 127 access points supporting mobile devices on the production floor. The implementation required certificate chain updates for the RADIUS infrastructure, firmware updates on all access points (11 units required hardware replacement due to insufficient cryptographic capability), and client configuration updates on 340 devices.
The migration revealed that 23 older tablets used for quality control documentation were incapable of supporting WPA3-Enterprise with 192-bit security. These devices were isolated to a separate SSID with WPA3-Personal and additional network segmentation controls until replacement devices could be procured and validated against the facility's manufacturing execution system.
---
Wireless networks represent one of the most accessible attack surfaces in any physical environment. Unlike wired network access, which requires physical presence inside a facility, Wi-Fi signals routinely extend beyond building perimeters. An attacker in a parking structure, a neighboring office, or a vehicle parked on the street can interact with wireless infrastructure without ever entering a controlled space.
WPA2's vulnerability surface is well-documented and actively exploited. The KRACK (Key Reinstallation Attack) vulnerability, published by Mathy Vanhoef in 2017, demonstrated that the WPA2 four-way handshake could be manipulated to reinstall cryptographic keys, potentially allowing decryption or replay of traffic. KRACK required patching across every client device and access point, and many IoT devices in enterprise environments never received those patches.
The PMKID attack, published by Jens Steube in 2018, removed even the need to wait for a client to authenticate. An attacker could request the PMKID directly from an access point and immediately begin offline cracking. This attack vector is particularly dangerous because it requires no client activity and can be automated across multiple targets.
Without WPA3, organizations face several concrete risks: network password compromise from passive capture and offline cracking; client eviction through forged deauthentication; passive eavesdropping on open guest networks; and inability to meet emerging compliance requirements that specify WPA3 or equivalent controls.
A common misconception is that a strong, long, random network password makes WPA2 safe. Password strength does raise the computational cost of cracking, but it does not eliminate the vulnerability. A 15-character random password may resist cracking for years; a 10-character password used across 200 access points in a distributed retail organization represents an acceptable target for a motivated attacker with GPU resources. The structural problem is that WPA2 allows the attempt at all, offline and unobserved. WPA3 eliminates the category of attack, not just the economics of it.
For compliance-driven organizations, the National Institute of Standards and Technology (NIST) Special Publication 800-153 (Guidelines for Securing Wireless Local Area Networks) includes wireless security configuration requirements. As WPA3 hardware becomes the baseline, auditors and assessors are beginning to flag WPA2-only configurations as findings. Early adoption reduces future remediation cost and audit friction.
The business impact extends beyond security vulnerabilities. Wireless infrastructure that cannot support modern security protocols faces accelerated obsolescence. As client devices and operating systems begin to prefer or require WPA3, WPA2-only networks will experience compatibility issues and degraded user experience.
---
CDA addresses wireless network security through the Vulnerability and Surface Defense (VSD) domain of the Planetary Defense Model, treating wireless infrastructure as an active attack surface that requires continuous reduction rather than periodic review. The methodology is Continuous Surface Reduction (CSR): every surface you expose is a surface we eliminate.
In practice, CDA approaches wireless security assessments by first mapping the complete RF footprint of an organization's wireless infrastructure, including shadow access points, personal hotspots, and rogue devices that have been connected to the network outside IT approval. This mapping is not a one-time audit; it is a continuous monitoring function integrated into the security operations workflow. An access point that appears between quarterly audits and disappears before the next one is not captured by periodic review. It is captured by continuous monitoring.
CDA's configuration baseline for wireless deployments specifies WPA3-Personal or WPA3-Enterprise as the required authentication mode, with WPA2 support permitted only under a documented exception with a defined sunset date. Transition mode configurations require compensating controls, including enhanced logging of authentication events and active detection of SSID-spoofing attempts.
For enterprise environments handling sensitive data, CDA applies WPA3-Enterprise with 192-bit security mode and validates certificate chain integrity for the RADIUS infrastructure supporting 802.1X authentication. A misconfigured certificate validation on the client side allows an attacker to present a fraudulent RADIUS server and capture credentials, even on WPA3-Enterprise networks. CDA client configuration reviews include explicit verification of this control.
CDA also addresses the human and process dimension. Wireless passwords on WPA3-Personal networks should be rotated on a defined schedule, access point firmware should be included in vulnerability management scanning, and guest networks should be isolated from corporate infrastructure at the layer 2 level, not just by VLAN policy.
The CSR principle applies to each of these elements. The goal is not to configure WPA3 and consider wireless security resolved; it is to continuously identify and close the surfaces that remain open after WPA3 deployment.
---
---
---