WPA2 (Wi-Fi Protected Access 2) has been the successor to WPA since 2004. Among the most important changes compared to WPA is the use of the AES encryption method. WPA2 eliminates the vulnerabilities of WPA that were discovered and is still considered very secure when a strong password is used, despite known attacks.
What is WPA2?
The WPA2 (Wi-Fi Protected Access 2) standard dates back to 2004 and is based on IEEE standard 802.11i. It is the successor to WPA and enables secure encryption and authentication in the WLAN. It should be noted that WPA2 is not completely identical to IEEE 802.11i and only implements parts of the IEEE standard.
Among the most important changes compared to WPA is the use of the greatly improved encryption method AES (Advanced Encryption Standard). Wi-Fi Protected Access 2 eliminates the weaknesses of WPA that were uncovered and, when used with a strong password (length and complexity), is still considered very secure encryption and authentication method today.
How Wi-Fi Protected Access 2 works
While WEP and WPA are based on the RC4 stream cipher scheme, WPA2 uses AES. The TKIP protocol (Temporal Key Integrity Protocol) of WPA is replaced by CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol). Due to the more complex encryption method, it is often not possible to switch from WEP or WPA to Wi-Fi Protected Access 2 via software, as more powerful hardware is required. Modern WLAN devices contain special chipsets that provide hardware acceleration for encryption.
AES is the successor to DES (Data Encryption Standard). It is a symmetrical encryption method that offers a high level of security. To date, there are no known practically relevant attack methods on AES encryption. AES uses an eight to 63-character password to determine a 128-bit individual key. This is negotiated between the client and the access point. It is calculated using a 48-bit long initialization vector (IV). To prevent the repetition of the key in the transmitted data packets, the client and access point renegotiate the key at regular intervals.
As with WPA, WPA2 allows authentication via pre-shared key (PSK) or via a central authentication server such as a Radius server. PSK authentication is called Personal Mode and central authentication Enterprise Mode.
The weak points of Wi-Fi Protected Access 2
For a long time, only password attacks were known for WPA2. For sufficient WLAN security, it is recommended to choose a password that is at least 20 characters long with upper and lower case letters, numbers, and special characters that cannot be found in dictionaries.
In 2017, researchers published an attack method on Wi-Fi Protected Access 2 called Key Reinstallation Attack (KRACK). It exploits weaknesses in connection establishment and key negotiation in the handshake process. Data packets can be decrypted with KRACK and attacks such as TCP hijacking or HTTP injection can be carried out.
In the worst case, the encryption can be completely leveraged. However, primarily client-side Android, Linux, and GNU implementations are affected by the KRACK vulnerability. Apple or Windows devices have parts of the vulnerability. Patches exist for a majority of affected devices that fix the vulnerability.
Another vulnerability in WPA2-secured WLANs arises when using Wi-Fi Protected Setup (WPS). WPS simplifies the configuration of WLAN devices but is vulnerable to attack. WPS should therefore remain deactivated on WLAN routers and access points. In general, a WPA2 WLAN protected with a long, complex password and up-to-date software with CCMP and AES is very secure.
Information Security Asia is the go-to website for the latest cybersecurity and tech news in various sectors. Our expert writers provide insights and analysis that you can trust, so you can stay ahead of the curve and protect your business. Whether you are a small business, an enterprise or even a government agency, we have the latest updates and advice for all aspects of cybersecurity.
