Overview & IEEE Standard3 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| IEEE basis | Pre-802.11i (RC4) | IEEE 802.11i (transitional) | IEEE 802.11i | IEEE 802.11i + 802.1X | IEEE 802.11-2020 / SAE | IEEE 802.11-2020 + 802.1X | RFC 8110 (OWE) / WFA Enhanced Open | |
| Wi-Fi Alliance cert year | 1999 (original Wi-Fi) | 2003 (WPA1) | 2004 (WPA2) | 2004 (WPA2-Ent) | 2018 (WPA3) | 2018 (WPA3-Ent) | 2018 (OWE) | |
| Status | ⛔ Broken - do not use | ⛔ Deprecated (TKIP broken 2009) | ✅ Acceptable (PSK); MFP recommended | ✅ Recommended for enterprise | ✅ Recommended for personal networks | ✅ Best practice for enterprise | ✅ Use for open networks (replaces open auth) |
Cipher & Key Exchange4 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| Encryption cipher | RC4 (WEP40 / WEP104) | RC4 via TKIP | AES-CCMP (128-bit) | AES-CCMP (128-bit) | AES-CCMP (128-bit) | AES-CCMP-128 (standard); GCMP-256 (192-bit mode option) | AES-CCMP (128-bit) | |
| Key length (bits) | 40 or 104 | 128 (TKIP per-packet key mixing) | 128 | 128 | 128 (256 optional) | 192 (CNSA suite) or 128 | 128 | |
| Key exchange / handshake | Static pre-shared key | 4-way handshake (PMK from PSK) | 4-way handshake (PMK from PSK) | 802.1X EAP + 4-way handshake | SAE (Simultaneous Auth of Equals / Dragonfly) | 802.1X EAP + SAE or TLS 1.3 | DH key exchange (per session) | |
| Forward secrecy | No | No | No (PSK derived PMK reused) | No (unless TTLS/EAP-TLS) | Yes (SAE generates fresh PMK per session) | Yes (with TLS 1.3 EAP methods) | Yes (DH per session) |
Authentication3 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| Authentication method | Open System or Shared Key (both broken) | PSK (passphrase → PMK) | PSK (PBKDF2-SHA1, 4096 iter) | EAP (PEAP, EAP-TLS, EAP-TTLS, etc.) | SAE (based on SPEKE / Dragonfly) | EAP-TLS recommended (mutual cert auth) | None (but encrypted after assoc) | |
| Identity protection | None | None | None (SSID visible pre-auth) | Partial (depends on EAP method) | Yes (SAE hides passphrase from sniffing) | Yes (TLS tunnel protects identity) | Yes (exchange is encrypted) | |
| Offline dictionary attack possible? | Yes (trivially) | Yes (4-way handshake capture + crack) | Yes (capture PMK handshake + PBKDF2 attack) | Very difficult (no PMK in air) | No (SAE prevents offline attacks) | No | N/A (no password) |
Management Frame Protection2 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| PMF (802.11w) requirement | No | Optional | Optional (recommended) | Optional (recommended) | Mandatory | Mandatory | Mandatory | |
| Deauth/disassoc protection | None | None | Only if PMF enabled | Only if PMF enabled | Always protected (PMF mandatory) | Always protected | Always protected |
Known Vulnerabilities2 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| Key vulnerability / attack | FMS / KoreK / PTW attacks; cracked in <60 s | TKIP MIC (Michael) attacks; Beck-Tews; deprecated | KRACK (key reinstall, patched); PMKID offline attack | KRACK (patched); EAP method specific (PEAP/GTC) | DragonBlood (timing/cache side-channel, partially patched) | EAP method dependent; certificate validation critical | SSID correlation attack (minor) | |
| CVE examples | CVE-2002-0531 (WEP) | CVE-2008-2629 (TKIP) | CVE-2017-13077 to 13088 (KRACK) | CVE-2017-13077 to 13088 (KRACK) | CVE-2019-9494/9496 (DragonBlood) | EAP-PEAP impersonation risks | N/A |
Wi-Fi Generation Requirements2 rows#
| Parameter | WEP | WPA (TKIP) | WPA2-Personal | WPA2-Enterprise | WPA3-Personal (SAE) | WPA3-Enterprise | OWE (Enhanced Open) | Notes |
|---|---|---|---|---|---|---|---|---|
| Minimum required for Wi-Fi cert | Never required (optional/deprecated) | No longer accepted (since WPA2 mandate) | Wi-Fi 4 (n): WPA2 minimum | Wi-Fi 4 (n): WPA2 Enterprise option | Wi-Fi 6 (ax): WPA3 mandatory | Wi-Fi 6 (ax): WPA3-Ent option | OWE mandatory for OPEN networks on 6 GHz (WFA) | |
| Works on 6 GHz band? | No (6 GHz requires WPA3) | No | No (WPA3 mandatory on 6 GHz) | No (WPA3-Ent mandatory on 6 GHz) | Yes | Yes | Yes (open 6 GHz) |