What is WPA3 and how can I use it?

WPA3 is a WiFi security standard that replaces WPA2 and addresses some of the latter’s security shortcomings. In this post, we look at what WPA3 is, how it works, and how you can set it up on your router.

What is WiFi encryption? A timeline

Here’s an overview of WiFi encryption and how it’s changed over the years.

Wired Equivalent Privacy (WEP)

When designing the first wireless networks in the late 1990s, we needed a level of security comparable to that of wired connections, which couldn’t be compromised “over the air.” The solution came in the form of WEP, or Wired Equivalent Privacy, introduced in 1997.

From the start, WEP didn’t provide robust security, and early WiFi users were vulnerable to attacks. The protocol was replaced with WPA in 2003.

WiFi Protected Access (WPA)

WPA was a significant improvement, but because it used TKIP (Temporal Key Integrity Protocol) for encryption, it was still vulnerable to attack.

While TKIP provided far better encryption than what was available in WEP, it ended up being considered insecure for several reasons:

  • Weak encryption: TKIP uses the RC4 stream cipher, which now has known vulnerabilities. Over time, various attacks have been developed to exploit weaknesses in RC4, making it much less secure than more modern encryption methods.
  • Key management issues: TKIP dynamically changes encryption keys to enhance security. However, the key management process has vulnerabilities that can be exploited, potentially allowing attackers to recover the keys.
  • Replay attacks: TKIP is susceptible to replay attacks, where attackers can capture and resend packets to gain unauthorized access or disrupt communications.
  • Limited key size: TKIP uses a 128-bit key, which, while better than older protocols, is still considered less secure than the 256-bit keys used to protect most connections today.

Because of the above, WPA was replaced by WPA2 in 2003.

WiFi Protected Access 2 (WPA2)

When the WiFi Alliance released WiFi Protected Access II (WPA2), it included many improvements over WPA. One of the most notable “upgrades” was the transition to the more secure AES (Advanced Encryption Standard) instead of TKIP.

AES has quite a few security benefits over TKIP:

  • Stronger encryption algorithm: AES uses a block cipher with a fixed block size of 128 bits and key sizes of 128, 192, or 256 bits. This provides a much higher security level than TKIP, which relies on the vulnerable RC4 stream cipher.
  • Resistance to cryptanalysis: AES has been extensively analyzed and is resistant to various forms of cryptanalysis. RC4, on the other hand, has been found to have several weaknesses that attackers can exploit.
  • Better key management: AES supports more robust key management. It allows for longer keys and more complex key schedules, enhancing security. TKIP’s key management, while an improvement over WEP, still has vulnerabilities that can be exploited.
  • No known practical attacks: As of the time of writing, there are no known practical attacks against AES that can be executed reasonably with current technology. This is not the case with TKIP and RC4.
  • More modern security standards: AES is the encryption standard recommended by the U.S. government and is widely adopted in many security protocols, including WPA2 and WPA3 for wireless networks.
  • Supports more advanced features: AES supports different ciphers (CBC, GCM, etc.) that provide additional security features, such as integrity and authenticity checks.

If you’re like most people and haven’t purchased a new router in a few years, it probably uses WPA2 by default. Until 2018, it was the most secure version of the WPA protocol.

WiFi Protected Access 3 (WPA3)

In 2018, the Wi-Fi Alliance introduced WiFi Protected Access III (WPA3), and in 2020, support for the protocol became mandatory for manufacturers to obtain WiFi certifications.

WPA3 supersedes WPA2 for a few reasons:

  • Improved encryption: WPA3 uses a more robust encryption protocol called Simultaneous Authentication of Equals (SAE). It replaces the Pre-Shared Key (PSK) method used in WPA2. SAE provides better protection against offline dictionary attacks, making it harder for attackers to guess passwords. Additionally, WPA3-Enterprise supports 192-bit encryption, going above and beyond the 128-bit encryption typically used in WPA2-Enterprise.
  • Forward secrecy: WPA3 offers forward secrecy, which means that even if a password is compromised, past sessions remain secure. Each session generates unique encryption keys, so attackers cannot decrypt past or future communications even if they obtain the current session key.
  • Stronger authentication: WPA3 includes improved authentication methods that make it more resistant to brute-force attacks. SAE ensures that only authorized users can connect to the network.
  • Rate limiting on password attempts: WPA3 limits the number of incorrect password attempts that can be made in a small time window. This rate limiting makes it harder for attackers to guess passwords using brute-force methods.
  • Enhanced protection for open networks: WPA3 introduces Opportunistic Wireless Encryption (OWE) for open networks, which encrypts data even when no password is required. This helps protect users on public WiFi networks from eavesdropping.
  • Increased security for IoT devices: Tied to the above, WPA3 is designed to better secure Internet of Things (IoT) devices, which often have weaker security measures. It provides a more secure framework for connecting these devices to the network.

WPA3: A closer look

Let’s look at some of WPA3’s features more closely.

Enforced Protected Management Frames (PMF)

One of the reasons WPA3 is more secure is that it uses Protected Management Frames (PMF).

Network frames transmit information regarding authentication, de-authentication, and probe requests and responses. Management frames are messages that help your devices communicate with the WiFi router. These behind-the-scenes signals keep everything running smoothly and securely between your devices and the router. With PMF, those transmissions are encrypted rather than sent out in the clear.

PMF isn’t new technology. It was first introduced in 2009. However, it wasn’t included in any WPA certification requirements until WPA3. If you buy a new router today, you should see “Enforced PMF” in the specifications.

Enforced PMF protects against a host of exploits:

Protection against brute force attacks

WPA3’s enhanced security better protects against brute force attacks because it uses Simultaneous Authentication of Equals (SAE) rather than Pre-Shared Keys (PSK).

WPA2 uses a pre-shared key, which is essentially a password/passphrase, to authenticate your device and provide a connection to the router. That makes WPA2 susceptible to brute-force attacks, in which an attacker makes multiple attempts at guessing the password over and over until they find a match (brute-force attacks are, of course, automated using software).

Making matters worse, WPA2 uses the same pre-shared key for every device that connects to the router. While convenient, particularly for small networks with just a few devices, it’s also a security risk; if the key is compromised, so is every device connected to the router.

SAE enhances security by allowing both parties to authenticate each other without directly sharing passwords, making brute-force attacks much more difficult to pull off.

Forward secrecy

Another benefit WPA3 has over WPA2 is forward secrecy. If you use WPA2 and your pre-shared key is compromised, all of your sessions (past and future) are compromised because WPA2 uses the same key.

With WPA3, you set a unique key for each session – that’s forward secrecy. So, let’s say you’re connected to your WPA3 router while browsing the internet, and an attacker can obtain your key. In that event, only the data from that specific session will be compromised. The attacker won’t be able to access your past or future sessions because those sessions use a different key.

192-bit encryption for enterprise

WPA has two variants: personal and enterprise. The main difference between the two is that the personal variant uses a passphrase to connect, while the enterprise variant uses certificates (or both certificates and a password). As its name states, the enterprise variant is typically reserved for larger deployments in a business setting. However, with the advent of WPA3, enterprise users got an added enhancement: 192-bit encryption for extremely robust security.

Again, this is not something you’d likely set up at home. But WPA3-Enterprise in 192-bit mode will provide the best security for business users who deal with sensitive data. Just bear in mind that only newer devices will support the specification.

Opportunistic Wireless Encryption (OWE)

One of the most significant security holes when using WiFi is open networks. A passphrase does not protect public hotspots and provides no encryption on the connection between the device and the router. It’s not a vulnerability per se, as the network was purposely set up to be open. But it makes you vulnerable to attacks. One of the WiFi Alliance’s greatest security enhancements is Opportunistic Wireless Encryption (OWE), which uses a feature called WiFi Enhanced Open.

WiFi Enhanced Open enables unauthenticated encryption between the router and individual clients over open networks. It’s unauthenticated because there’s no passphrase to enter to connect to the router.

It works like this:

  1. Key creation: When a user connects to the OWE-enabled router, a unique encryption key is created for that user only.
  2. Key exchange (Diffie-Hellman): The cryptographic keys are exchanged over the public channel (the unsecured network).
  3. Encryption: After the key exchange, all data transmitted between the router and the connected device is encrypted with the established key.

OWE networks protect individual users from snooping and other attacks like session hijacking. However, although OWE provides data privacy, it doesn’t offer authentication. Therefore, while the data is encrypted, there is no verification of the network’s identity, leaving room for attacks like rogue access points or man-in-the-middle attacks.

Unlike typical wireless security measures that require authentication, OWE’s encryption is unauthenticated. So, while the data is encrypted, the network’s identity is never validated, leaving the door open to man-in-the-middle or evil twin attacks. OWE’s primary goal is to enhance the security of open networks – and it achieves it – but OWE is not a substitute for a properly secured network.

CCMP vs. GCMP

Another enhancement of WPA3 over WPA2 is the integration of GCMP, which supersedes CCMP for data integrity and encryption.

CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) and GCMP (Galois/Counter Mode Protocol) are two cryptographic protocols to secure WiFi networks. Both protocols utilize the Advanced Encryption Standard (AES) for encryption, but they operate differently and provide different levels of security and performance.

CCMP provides data confidentiality, integrity, and authenticity through the Advanced Encryption Standard (AES) in counter mode for encryption. It encrypts data packets with a unique keystream generated by combining a nonce (a number used once) and a session key to ensure that identical plaintext blocks are encrypted into different ciphertext blocks.

CCMP also uses a Message Integrity Check (MIC) based on the CBC-MAC (Cipher Block Chaining Message Authentication Code) method to verify that the data was not tampered with during transmission.

However, because it relies on the CBC-MAC for message integrity, CCMP can be susceptible to replay and key recovery attacks if not correctly implemented. Consequently, WPA3 uses the more advanced GCMP (Galois/Counter Mode Protocol).

GCMP combines encryption and authentication in a single process using the Galois/Counter Mode of the Advanced Encryption Standard (AES). So, it simultaneously encrypts data packets while generating a Galois Message Authentication Code (GMAC) to ensure message integrity and authenticity.

Because both encryption and authentication are performed in one step, latency is reduced, and overall performance is greatly improved. GCMP ensures that every data packet is unique by using different nonces and sequence numbers. If a packet is retransmitted with a previously used nonce or an out-of-order sequence number, the receiving end can detect it as a duplicate and discard it, preventing replay attacks.

Configuring your router to use WPA3

The first step in enabling WPA3 on our router is to check whether it supports the protocol.

Here are different ways you can do that:

  • Check your router’s manual: Look for the user guide bundled with your router. You may need to download it from the manufacturer’s website. Once you have it, check for WPA3 support.
  • Check the router’s specifications on the manufacturer’s website: If you can’t find a physical copy of your router’s user guide and can’t find a download link for it, another avenue would be to look for WPA3 support in the router’s spec sheet on the manufacturer’s website. It may be all you need.
  • Check the router’s WiFi security section: If you can’t find any documentation that explains its support for WPA3, you can also simply log in to your router’s web interface and check if WPA3 is an option in the WiFi security pages. We’ll provide the steps to do that below.

Updating your router’s firmware

Perhaps your router doesn’t support WPA3, but the feature was added to a firmware update. So, you’ll need to update the firmware to the latest version.

To update your router’s firmware:

  1. Log in to your router’s web interface: Open a web browser and type the router’s IP address ( 192.168.0.1 and 192.168.1.1 are very common). The router’s default IP address and credentials are typically printed on the bottom of the router. Log in with the listed credentials if you have never changed them. If you did, use your custom credentials.
  2. Check for firmware updates: Navigate to the firmware update section of your router’s web interface. It’s usually found in the administration or the advanced settings pages.
  3. Download and install the updated firmware: Download the latest firmware version from the manufacturer’s website and follow the installation instructions. For example, you may need to decompress the downloaded file before running the update.

Setting your router’s WiFi to use WPA3

We’re now ready to enable WPA3 on our router:

  1. Log in to your router’s web interface: As above, launch a web browser and type the router’s IP address. Then, log in with your credentials.
  2. Navigate to the wireless settings page: Look for a tab called WiFi, Wireless, Wireless Security, or WiFi Security. The settings may be tucked away in an Advanced Settings section of the page.
  3. Select WPA3 as the security protocol: Look for a security protocol section on the WiFi Security page (or whatever it’s called on your router). It’s typically a drop-down menu. Select WPA3.
  4. Choose the encryption method (your router may not present this option): This may or may not be available on your router. Some routers provide more granularity than others. If you’re presented with encryption options, it will typically be a choice between CCMP and GCMP. If you have newer devices, select GCMP. If you have older devices, they may only support CCMP. You may need to experiment to find the best setting for your network/devices.
  5. Set the authentication method (your router may not present this option): If the option is present, set the authentication method to SAE (Simultaneous Authentication of Equals).
  6. Save and apply the changes: Your router may require a reboot.

Tips for a more secure WPA3 network

These are common-sense tips you should follow to optimize the security and performance of your WPA3 Wi-Fi network:

  • Set a strong WiFi password: Use a long, complex, unique passphrase for your WPA3 network.
  • Set up a guest network: Configure your router to provide a guest network for visitors, locking them out of your local network (LAN).
  • Keep your router’s firmware updated: If possible, configure your router for automatic updates. If not, manually check for updates regularly to ensure you have the latest security patches and features.

Wrapping up on WPA3

WPA3 is the latest and greatest protocol for WiFi security. If your router supports it and you’re not already using WPA3, you should be. It will significantly upgrade your online security.

If your router doesn’t support it, there’s a good chance you’re using an old router that hasn’t been updated in a very long time (maybe even never…). If that’s your situation, you may consider getting a new router to benefit from the latest security standards.

In any case, stay safe.