Core: Wireless

Wireless security

Miro Kosut

Miro Kosut

— 4 min read
Share

Requirement / business driver

Authenticate and encrypt wireless access appropriately for enterprise, personal, and guest use - the air is an open medium.

The options

  • WPA2 - AES-CCMP (avoid legacy TKIP); WPA2-Enterprise uses 802.1X/EAP (AAA and identity - RADIUS, TACACS+, 802.1X), WPA2-Personal uses a pre-shared key.
  • WPA3 - the current standard: WPA3-Personal uses SAE (resists offline PSK cracking), WPA3-Enterprise strengthens 802.1X (optional 192-bit suite), and PMF (management-frame protection) is mandatory.
  • OWE (Enhanced Open) - encrypts open/guest networks (no password) so guest traffic isn't in the clear. Note the band rule: 6 GHz / Wi-Fi 7 mandates the WPA3 family, so an "open" SSID there must be OWE - and OWE transition mode is not permitted in 6 GHz, so mixed-client designs keep separate SSIDs per band.

Design choices

WPA3 fine print - why SAE is stronger and how transitions go wrong

SAE (the Dragonfly handshake) is a balanced PAKE: both sides prove knowledge of the passphrase without ever exposing an offline-attackable digest, so - unlike WPA2-PSK, where one captured four-way handshake feeds a dictionary rig - security no longer rides on passphrase entropy, and each session gets forward secrecy (a passphrase leak tomorrow does not decrypt today's captures). The residual risk is the transition period: mixed WPA2+WPA3 SSIDs reopen the downgrade door (an evil twin advertising WPA2-only harvests the old handshake - the Dragonblood attack family), so enable Transition Disable - clients that have seen WPA3 refuse to fall back on later joins - and treat transition mode as scaffolding with a removal date. 6 GHz forces the endgame anyway: WPA3/OWE only, no transition modes.

For the non-802.1X estate, per-device or per-group identity PSKs on a single SSID (keys looked up per client at join, typically via the MAC-auth path) buy the property a shared PSK can never have: revoking one device does not rotate everybody. Blast radius of a leaked key shrinks from the whole SSID to one endpoint/class, and each key can carry its own authorisation (VLAN/SGT) - the pragmatic bridge for IoT until certificates are feasible (Network access control and segmentation - NAC, TrustSec, guest and BYOD).

Rogue handling when PMF removes your weapon

Classic rogue containment is a spoofed deauthentication flood - and 802.11w/PMF authenticates exactly those frames. The same mechanism that stops attackers deauthing your clients stops your WIPS deauthing rogue APs and their clients: in a WPA3 world, containment-by-frame-spoofing fades, so the strategy shifts to detect -> locate -> remove - continuous detection, physical location of the rogue, and wired-side denial: 802.1X on access ports so a rogue AP cannot bridge onward, plus rogue-on-wire correlation (a rogue's client MAC appearing behind an inside switchport proves the bridge). Detection itself is an architecture choice with a cost triangle: serving APs scanning off-channel (free, but each dwell steals airtime and detection is slow), dedicated monitor-mode APs (continuous full-band watch, extra units), or APs with a dedicated scanning radio (continuous watch with zero service impact, premium hardware) - pick per the site's threat level and airtime budget (WLAN architectures). And classify before acting: most rogues are neighbours, and containing a legitimate neighbour is both a self-inflicted outage and, in many jurisdictions, a regulatory violation.

Recommendation / justification

Default to WPA3-Enterprise + 802.1X for corporate (identity-based, integrates with NAC/zero trust Zero Trust and ZTNA), OWE/portal for guest in an isolated segment, and enforce PMF while dropping TKIP/WEP. Justify by the open medium and the need for identity-driven access.

What would change this (mid-scenario twist)

  • Legacy clients can't do WPA3 -> transition/mixed mode temporarily, plan to retire.
  • IoT that can't do 802.1X -> MAB/identity PSK on a tightly segmented SSID.

Validation checks

  • Is corporate on 802.1X (WPA2/WPA3-Enterprise) with NAC, and guest isolated (OWE/portal)?
  • Are TKIP/WEP gone and PMF enabled?

IPv6 / dual-stack note

802.1X/encryption are family-agnostic; ensure the guest/segment isolation and first-hop security (Layer 2 security) cover IPv6 too.

Spaced repetition

WPA3-Personal's SAE improves on WPA2-PSK by [...].

WPA3-Personal's SAE improves on WPA2-PSK by resisting offline dictionary/PSK cracking (and adding forward secrecy).

What does OWE provide?

Encryption for open/guest networks (no password) so guest traffic isn't sent in the clear ("Enhanced Open").

Corporate wireless default: [...]; guest: [...].

Corporate wireless default: WPA3-Enterprise with 802.1X/EAP-TLS, tied to NAC for identity + posture + segment; guest: isolated segment with OWE/portal.

Why does SAE remove the "strong passphrase" dependency that WPA2-PSK has?

It is a balanced PAKE - no offline-attackable material leaves the exchange, so captured handshakes cannot be dictionary-attacked, and sessions gain forward secrecy.

Transition Disable exists because [...].

Transition Disable exists because mixed WPA2/WPA3 SSIDs reopen downgrade (evil-twin WPA2) attacks - clients that have seen WPA3 refuse later WPA2 fallback.

How does PMF change rogue containment strategy?

802.11w authenticates deauth/disassoc frames, so spoofed-deauth containment stops working - shift to detect -> physically locate -> wired-side denial (802.1X on access ports, rogue-on-wire correlation).

Sources

  • Cisco Live BRKEWN-2104 (Krischer, 2024): SAE/Dragonfly properties, Transition Disable, identity PSK, PMF-era rogue strategy, scanning options.
  • Cisco Press, SCOR and Cisco Wireless security; Wi-Fi Alliance WPA3/OWE.

domain: Core · blueprint-ref: Core 6.1.f Wireless security (WPA/WPA2/WPA3, TKIP, AES, OWE) · type: design-decision · status: complete · tags: [core, core/wireless, tradeoff/security]

Read more