Differences between WPA2 and WPA3

WPA2 vs. WPA3

Wi-Fi Protected Access 2 (WPA2) and Wi-Fi Protected Access 3 (WPA3) are security protocols used to secure wireless computer networks. WPA2 became the standard in 2004, offering robust security for many years. However, vulnerabilities such as the Key Reinstallation Attack (KRACK) exposed weaknesses in the protocol. In response, the Wi-Fi Alliance introduced WPA3 in 2018 to address these flaws and provide stronger security measures. WPA3 offers significant upgrades over WPA2, particularly in authentication, encryption, and protection on public networks.

Comparison Table

Category	WPA2	WPA3
Authentication	Pre-Shared Key (PSK)	Simultaneous Authentication of Equals (SAE)
Vulnerability to Offline Dictionary Attacks	Vulnerable, as an attacker can capture the 4-way handshake and attempt to crack the password offline.	Resistant, SAE protocol protects against offline dictionary attacks.
Public Network Security	No encryption on open networks, leaving data exposed.	Encrypts traffic on open networks through Opportunistic Wireless Encryption (OWE).
Forward Secrecy	Not supported; a compromised password can decrypt past captured traffic.	Supported; a compromised password cannot decrypt previously captured sessions.
Encryption Strength (Personal)	128-bit AES-CCMP encryption.	128-bit AES encryption is standard, with an option for 192-bit in some cases.
Encryption Strength (Enterprise)	128-bit AES-CCMP encryption.	Requires 192-bit AES encryption (in WPA3-Enterprise mode).
Management Frame Protection	Optional.	Mandatory.

Venn diagram comparing Differences between WPA2 and WPA3

Authentication and Attack Resistance

The most significant difference between WPA2 and WPA3 lies in the authentication process. WPA2 uses a Pre-Shared Key (PSK), which involves a four-way handshake that is susceptible to offline dictionary attacks. An attacker can capture this handshake and repeatedly guess the password offline until they succeed. WPA3 replaces PSK with Simultaneous Authentication of Equals (SAE), also known as Dragonfly. SAE is a more secure key exchange protocol that protects against these attacks, even when users choose simple passwords. It prevents an attacker from making more than one password guess at a time, requiring interaction with the Wi-Fi device for each attempt. This renders offline brute-force attacks impractical.

Public Network Security

WPA2 offers no inherent encryption on open public networks, such as those in coffee shops or airports. This lack of privacy allows for passive eavesdropping by anyone on the same network. WPA3 addresses this with Opportunistic Wireless Encryption (OWE), which is part of its Wi-Fi Enhanced Open feature. OWE provides individualized encryption for each user's connection to the access point on an open network without requiring a password. This protects against passive listening from other users on the network.

Encryption and Forward Secrecy

While both protocols use strong AES encryption, WPA3 enhances it. For personal networks, WPA3 still uses 128-bit encryption but offers stronger protection through the SAE handshake. For enterprise networks, WPA3 mandates a higher 192-bit encryption strength.

WPA3 also introduces support for forward secrecy. Under WPA2, if an attacker discovers the network password, they can decrypt any previously captured traffic that used that same password. With WPA3's forward secrecy, a unique session key is generated for each connection. This means that even if one session key is compromised, it cannot be used to decrypt past or future sessions, significantly improving data privacy.

Protected Management Frames

Protected Management Frames (PMF), or IEEE 802.11w, protect against eavesdropping and forgery of certain Wi-Fi management frames, such as deauthentication and disassociation frames which can be used to disrupt a network. While PMF was optional in WPA2, WPA3 requires it for all connections. This mandatory implementation enhances the resilience of WPA3 networks against denial-of-service and other disruption attempts.