| WPA3-Personal | v3.1 | 2022 (v3.1) | • SAE (Simultaneous Authentication of Equals) mandatory
• PMF (802.11w) mandatory for all unicast frames
• SAE H2E (Hash-to-Element) mandatory (eliminates DragonBlood timing attacks)
• Transition Disable element support
• Forward secrecy: each SAE exchange generates fresh PMK | • TKIP prohibited
• WEP prohibited
• 40-bit / 104-bit RC4 prohibited
• SAE Hunting-and-Pecking deprecated (use H2E) | SAE (Dragonfly / RFC 8492)
IEEE 802.11-2020 §12.4 | wlan.rsn.akms.type==8 (SAE)
wlan.rsn.pcs.type==4 (CCMP-128) mandatory
SAE commit: wlan.fc.type_subtype==11 && wlan.auth.alg==3 |
| WPA3-Enterprise | v3.1 | 2022 (v3.1) | • 802.1X EAP authentication
• PMF mandatory
• CCMP-128 minimum cipher
• Server certificate validation mandatory
• TLS 1.2 minimum (TLS 1.3 recommended via RFC 9190) | • TKIP prohibited
• EAP methods without server cert validation prohibited
• Static WEP prohibited | EAP-TLS, PEAP, EAP-TTLS
IEEE 802.1X-2020 | wlan.rsn.akms.type==1 (802.1X)
wlan.rsn.pcs.type==4 (CCMP-128) |
| WPA3-Enterprise 192-bit | v3.1 | 2022 | • GCMP-256 encryption mandatory
• BIP-GMAC-256 for management frame protection
• EAP-TLS with 384-bit elliptic curve or 3072-bit RSA
• HMAC-SHA-384 for KCK+KEK
• PTK = 704 bits (KCK-192 + KEK-256 + TK-256; derived via KDF-SHA384-256) | • CCMP-128 not sufficient (GCMP-256 required)
• EAP methods with <192-bit security prohibited | GCMP-256, BIP-GMAC-256
384-bit ECC certs
3GPP CNSA suite | wlan.rsn.akms.type==12 (802.1X+SHA384)
wlan.rsn.pcs.type==9 (GCMP-256) |
| OWE (Enhanced Open) | v1.1 | 2018 | • Diffie-Hellman key exchange for open networks
• Unauthenticated but encrypted (each STA gets unique session key)
• PMF mandatory
• Compatible with open network UX (no password) | • Unencrypted open association prohibited on OWE-capable BSS
• Legacy open auth on 6 GHz prohibited | OWE: RFC 8110
IEEE 802.11-2020 §12.12 | wlan.rsn.akms.type==18 (OWE)
Assoc Request contains OWE DHE (Diffie-Hellman Parameter) element |
| WPA3 Transition Mode | v3.1 | 2022 | • AP advertises both WPA2-PSK and WPA3-SAE simultaneously
• Legacy clients: use WPA2-PSK with PMF optional
• WPA3 clients: use SAE with PMF mandatory
• Transition Disable: AP can mandate WPA3-only after first successful WPA3 auth | • TKIP prohibited in transition mode
• WPA2-only without PMF deprecated | Transition Disable element (IEEE 802.11-2020) | Two RSN IEs in Beacon: one WPA2, one WPA3
wlan.rsn.akms includes both type==2 (PSK) and type==8 (SAE) |
| Passpoint (Hotspot 2.0) R3 | v3.1.0 | 2021 | • 802.11u Interworking element
• GAS (Generic Advertisement Service) protocol
• ANQP (Access Network Query Protocol) for network info
• WPA2/WPA3-Enterprise mandatory
• OSU (Online Sign-Up) server for provisioning
• NAI realm list for EAP method discovery | • Open/WPA-Personal prohibited for Passpoint BSS
• WEP/TKIP prohibited | IEEE 802.11u-2011
RFC 2486 (NAI)
OMA DM for provisioning | wlan.rsn.interworking present in Beacon
GAS: wlan.fc.type_subtype==13 category==4
ANQP: wlan_anqp queries |
| Wi-Fi Direct (P2P) | v1.9 | 2021 | • Device discovery (P2P Probe Req/Resp)
• GO (Group Owner) negotiation
• P2P group formation
• WPS provisioning (PBC mandatory, PIN optional)
• Service Discovery via Bonjour/UPnP/WS-Discovery
• Concurrent operation (P2P + infrastructure) | • No standalone mode without infrastructure capability on at least one interface
• Legacy WEP/TKIP deprecated | IEEE 802.11-2020 P2P extensions
Wi-Fi Alliance P2P Technical Spec v1.9 | P2P attribute in Probe Req vendor-specific IE
wlan.tag.vendor.oui.type==9 (Wi-Fi Alliance P2P) |
| Wi-Fi Aware (NAN) v4.0 | v4.0 | 2022 | • NAN Discovery Engine
• Discovery Window (DW): every 512 TU (~524 ms), STA wakes to publish/subscribe services
• NAN Data Path (NDP) for IP connectivity
• Ranging using 802.11az
• Pairing (secure device pairing without infrastructure) | • NAN on 6 GHz requires Wi-Fi 6E support | IEEE 802.11 NAN spec
Wi-Fi Alliance Aware v4.0 | NAN attribute cluster in Probe/Beacon
NAN SDF (Service Discovery Frame): vendor IE
wlan.nan.attr.type |
| DPP (EasyConnect) v2.0 | v2.0 | 2020 | • Bootstrapping: QR code / NFC / Bluetooth OOB / PKEX (passphrase-based)
• DPP Auth: Diffie-Hellman mutual authentication
• DPP Config: JSON credential delivery (PSK/SAE/Enterprise)
• DPP Network Access: direct association using DPP credentials
• Replaces WPS (no 8-digit PIN attack surface) | • WPS PIN method deprecated (Pixie Dust vulnerability)
• Legacy 8-digit PIN deprecated | DPP: Wi-Fi Alliance EasyConnect Spec v2.0
RFC 8949 (CBOR) for DPP objects | wlan.fc.type_subtype==13 category==255 DPP OUI
DPP Action frame: vendor specific
DPP bootstrapping: QR = URI encoding of public key |
| Wi-Fi CERTIFIED 6 (Wi-Fi 6) | v3.0 | 2019 (6); 2021 (6E) | • WPA3 mandatory (Personal or Enterprise)
• PMF mandatory for all unicast
• OWE mandatory for open network support
• TWT support mandatory
• BSS Color mandatory
• OFDMA DL/UL mandatory
• MU-MIMO DL mandatory (4 streams min)
• BCC + LDPC both required | • WPA2-only prohibited for Wi-Fi 6 certification
• No TKIP in Wi-Fi 6 BSS
• Legacy basic rates in 6 GHz prohibited
• DSSS/CCK preambles in 6 GHz prohibited | IEEE 802.11ax
Wi-Fi 6 Certification Program v3.0 | 802.11ax HE Capabilities IE
wlan.ext_tag.he_caps present
BSS Color: wlan.ext_tag.he_op.bss_color |
| Wi-Fi CERTIFIED 7 (Wi-Fi 7) | v1.0 | 2024 | • WPA3 mandatory
• MLO (Multi-Link Operation) mandatory
• 4096-QAM (MCS 12/13) mandatory
• Preamble puncturing mandatory
• 320 MHz optional but certified if present
• Enhanced Block Ack (256-bitmap) mandatory | • TKIP/WEP prohibited
• Legacy basic rates in 6 GHz prohibited | IEEE 802.11be
Wi-Fi 7 Certification Program v1.0 | EHT Capabilities IE
U-SIG field in PPDU
MLO element in Probe/Assoc frames |