Wi-Fi WEP WPA WPA WPA3

Shared key authentication methods

WEP (Shared Key) WPA (TKIP) 802.11i / WPA2 (CCMP/AES)
Authentication method Shared Key (challenge–response using WEP RC4 keystream) or Open System 802.1X/EAP (Enterprise) or PSK (Pre-Shared Key) with TKIP key management 802.1X/EAP (Enterprise) or PSK with RSN key management; 4-way handshake
Encryption RC4 stream cipher (WEP) with static per-network key and weak IV handling TKIP: RC4-based with per-packet key mixing, extended IV, and rekeying CCMP with AES (AES-CCM) — strong per-packet keys and nonce handling
Message integrity CRC-32 (no cryptographic MIC) — vulnerable to forgery Michael MIC (cryptographic MIC) — better than WEP but has weaknesses and relies on countermeasures AES-CCM provides strong integrity and authenticity (cryptographic MIC)
Security Weak — easily broken (IV reuse, key recovery, message forgery) Moderate — improved over WEP but deprecated; vulnerable to some attacks and downgrade/fallback issues Strong — current recommended standard when properly configured (AES-CCM + robust key management)

Open system authentication

  1. Client sends an authentication request to the AP
  2. AP returns an authentication response
  3. Client sends an association request to the AP
  4. AP sends an association response to the client

WEP Authentication

  1. Client sends an authentication request to the AP
  2. AP returns an authentication response with a challenge text
  3. The client responds with the challenge encrypted with the WEP key
  4. The AP decrypts the challenge and confirms the success or failure

WPA Authentication

  1. Client sends an authentication request
  2. AP returns an authentication response
  3. The client and AP calculate the PMK from the PSK
  4. The four-way handshake verifies the client and AP knows the PSK

WPA3 Authentication

  1. Client (supplicant) and AP (authenticator) perform the Simultaneous Authentication of Equals (SAE) exchange. Both parties generate ephemeral elliptic-curve or finite-field values and exchange commit messages containing scalar/public elements and element identifiers.
  2. Each side computes a shared secret from the exchanged values and their own password-derived secret (password-to-element step uses the passphrase).
  3. Both sides derive the Pairwise Master Key (PMK) and a PMK identifier (PMKID) from the shared secret and exchanged transcripts.
  4. A handshake (often called the SAE confirmation) follows: each side sends a confirm/message-authentication code proving possession of the derived keys and that the exchange wasn’t altered.
  5. Once confirms validate, the AP and client proceed to the 4-way handshake (or an equivalent key derivation step) to derive the Pairwise Transient Key (PTK) and install encryption keys for data traffic.
  6. Optionally, Protected Management Frames (PMF) and forward secrecy protections are enforced; SAE provides forward secrecy so compromise of the passphrase does not expose past session keys.
Enter your search text in the box above

Select a result to preview