Copyright (c) 2026 MindMesh Academy. All rights reserved. This content is proprietary and may not be reproduced or distributed without permission.
3.3.3. Wireless Security and Authentication
Security Protocols Evolution:
- WEP: Broken, never use (static keys, weak encryption)
- WPA: Improved but deprecated (TKIP encryption)
- WPA2: Current standard (AES encryption)
- WPA3: Latest standard (SAE authentication, stronger encryption)
What WPA3 improves over WPA2:
| Improvement | What it does |
|---|---|
| SAE (Simultaneous Authentication of Equals) | Replaces WPA2-Personal's pre-shared key exchange. Each guess at the password requires a live exchange with the AP, so a captured handshake can't be cracked offline with a dictionary attack |
| Forward secrecy | Traffic captured today can't be decrypted later, even if the Wi-Fi password is compromised afterwards |
| 192-bit security mode (WPA3-Enterprise) | Optional stronger cryptographic suite for sensitive environments such as government and finance |
| Protected Management Frames (PMF) required | Management frames are protected, which blocks forged deauthentication attacks that kick clients off the network |
WPA3 does not allow the legacy WEP or TKIP ciphers; it uses AES-based encryption.
Authentication Modes:
| Mode | How It Works | Use Case |
|---|---|---|
| WPA2-Personal (PSK) | One password shared by every device—a single leak exposes all of them, and changing it means reconfiguring every device | Home, small office |
| WPA2-Enterprise | Individual credentials via RADIUS/802.1X | Corporate environments |
| Open | No authentication | Guest networks (with captive portal) |
WPA2-Enterprise with 802.1X:
EAP (Extensible Authentication Protocol): Framework for various authentication methods:
- EAP-TLS: Client and server certificates (most secure)
- PEAP: Server certificate, client credentials
- EAP-TTLS: Like PEAP, only the server needs a certificate. Inside the TLS tunnel the client can use legacy, non-EAP methods such as PAP or CHAP (PEAP instead tunnels another EAP method, usually MS-CHAPv2)
- EAP-FAST: Cisco, uses Protected Access Credential (PAC)
Captive Portal: Redirects clients to authentication webpage before granting network access. Common for guest networks, hotels, airports.
Enroll to unlock the 8 practice questions written for this section, so you can test what you just read while it is fresh.
Enroll to unlock the 4 flashcards for this section and review them on a spaced-repetition schedule.
Written byAlvin Varughese
Founder•20 professional certifications