WPA3: The Cutting-Edge of WiFi Security

What is WPA3

Every generation of computer technology spawns both new promise and new problems. When the first universities allowed users to connect to powerful mainframes, unruly students found ways of accessing other student’s information to play pranks on each other, requiring the creation of password protection and access rights.

Today, computers and wireless networks occupy every aspect of life, from schools, hospitals, businesses, libraries — even coffee shops and buses offer WiFi access. But with all this access, there is the need for WiFi network security. A person connecting via their laptop could be transmitting the passwords to their bank account over the air for a hacker to pick up.

The biggest problem with allowing access to a local WiFi network isn’t just WiFi encryption, but how to register devices onto the WiFi network. If there’s a shared password, then anyone who shares that with another person or writes it down runs the risk of unauthorized users getting access to the network.

For those old enough, remember that scene from the movie “Wargames” where Matthew Broderick’s character would purposely get detention so he could find the network’s password written down in a secretary’s desk? Hackers use the same technique when someone writes down the WiFi password on a Post-It on their desk to get access into the network and start capturing packets.

WPA3 security is designed to help prevent that. Rather than relying on shared passwords, WPA3 signs up new devices through processes that don’t require the use of a shared password.

This new system, called Wi-Fi Device Provisioning Protocol (DPP), works by transmitting how to gain access to the system without transmitting a password into the air. With DPP, users use QR codes or NFC tags to let devices onto the network. By snapping a picture or receiving a radio signal from the router, a device can be authenticated to the network without sacrificing security.

WPA3 encryption is geared to be better than previous iterations of WiFi technology. First, like the move of browsers Google Chrome and Firefox to warn or outright block users from connecting to insecure web servers, WPA3 security discards older encryption mechanisms in favor of ones that have not been broken.

Granted, nothing lasts forever in the world of security, but WPA3 Encryption is covered by 256-bit Galois/Counter Mode Protocol (GCMP-256) so that makes breaking through the encryption harder.

How big is a number like 256-bit? Previous encryption algorithms worked with 128-bit encryption. In Math terms, that’s 3.048 x 10^38 — that’s 3 followed by 38 zeros after it — that’s how many calculations a computer would have to make to even guess at what the encryption key is. 256-bit encryption? That’s 1.15 x 10^77 — 1 with 77 zeroes following after it.

There is a fewer number of atoms in the known universe compared to that number. There are fewer episodes of Judge Judy than that number. Fewer times that someone has asked, “Explain the plot of the movie Inception.”

It’s a big number.

When transferring encryption keys between the router and devices, WPA3 WiFi Security uses 384-bit Hashed Message Authentication Mode so both the device and the router confirm that they can connect, but in a way where even if someone picks up the communication between them they can’t figure out what they original encryption key is.

It’s like the Navajo code talkers back in World War II who used codes while speaking a language no one else in the world understood. Even if a third party could pick up the radio signals, it wouldn’t make any sense to them. Even if they also happened to speak Navajo, they’d have to know the additional code structure underneath that to understand what the message actually meant.

This is how WPA3 keeps communications safe — with better encryption, better ways of setting up that encryption, and methods that keep people connecting to the network from knowing the passwords that have them on the network.

What are WPA3's weaknesses?

Wi-Fi Protected Access 3 (WPA3) was introduced to enhance the security of wireless networks by addressing vulnerabilities found in its predecessor, WPA2. However, like any security standard, WPA3 has its weaknesses and vulnerabilities that attackers can exploit. Here are some of the key weaknesses identified in WPA3:

• Dragonfly Handshake Vulnerabilities: WPA3 implements a new handshake protocol called Dragonfly (or Simultaneous Authentication of Equals, SAE) intended to offer protection against offline dictionary attacks. However, researchers have found vulnerabilities in this handshake process that could potentially allow attackers to perform side-channel attacks, such as timing or cache-based attacks, to retrieve information about the password being used.
• Downgrade Attacks: While WPA3 is designed to be more secure than WPA2, networks often support both standards to ensure backward compatibility. This opens up the possibility for downgrade attacks, where an attacker forces a device to connect using the less secure WPA2 protocol, thereby bypassing WPA3's security enhancements.
• Implementation Flaws: The security of a system also depends on how well the security protocols are implemented. Early on, some implementations of WPA3 were found to be susceptible to various attacks due to flaws in how the Dragonfly handshake was implemented. These issues allow attackers to bypass WPA3's security mechanisms under certain conditions.
• Limited Adoption and Compatibility Issues: The effectiveness of WPA3's security improvements is limited by its adoption rate. Many devices still use older Wi-Fi security protocols due to hardware limitations or lack of firmware updates. This slow adoption rate means that many networks remain vulnerable to attacks that WPA3 is designed to mitigate.

In conclusion, while WPA3 represents a significant step forward in wireless network security, it is not without its weaknesses. Ongoing research and updates are essential to address these vulnerabilities and enhance the security of wireless networks.