802.11 Security Protocols: WEP, WPA2, WPA3
Understand why WEP was broken, how WPA2 CCMP works, and what WPA3 SAE improves.
802.11 Security Protocols: WEP, WPA2, WPA3 is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Wi-Fi Security Evolution
Wireless security has evolved from the broken WEP through WPA/WPA2 to the modern WPA3. Understanding each generation reveals why the flaws existed and how each successor addressed them.
WEP: Fundamentally Broken
WEP (Wired Equivalent Privacy) used RC4 with a static 40-bit key and a weak 24-bit IV. IVs repeat after ~5000 packets, enabling key recovery in minutes with statistical analysis. WEP is completely broken and must never be used.
# WEP crack (for authorized lab use only)
# Capture IVs with airodump-ng
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# Force IV generation via ARP replay
aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon
# Crack the key
aircrack-ng capture-01.capWPA/TKIP: Interim Fix
WPA with TKIP (Temporal Key Integrity Protocol) was a software upgrade to WEP hardware. It used per-packet keys and MIC (Michael) for integrity. Still deprecated — TKIP is vulnerable to practical attacks.
WPA2: CCMP and AES
WPA2 replaced RC4+TKIP with AES-CCMP — a proper authenticated encryption scheme. WPA2-Personal uses a Pre-Shared Key (PSK); WPA2-Enterprise uses 802.1X/EAP with a RADIUS server for per-user authentication.
# WPA2 security properties:
# - AES-128 in CCMP mode
# - 128-bit session keys per association
# - 4-way handshake establishes PTK (Pairwise Transient Key)
# - PSK mode: shared password → PMK → PTK
# - Enterprise: EAP auth → per-user PMKWPA2 Weaknesses
WPA2-Personal is vulnerable to: offline dictionary attacks on captured 4-way handshakes, PMKID attacks (no client needed), and KRACK (key reinstallation — patched). The pre-shared key is the weakest link.
WPA3: SAE Handshake
WPA3 replaces PSK with SAE (Simultaneous Authentication of Equals), a Diffie-Hellman-based handshake that provides forward secrecy and resistance to offline dictionary attacks — even if someone captures the handshake.
# WPA3-Personal (SAE) benefits:
# - Forward secrecy: past traffic safe if key leaked
# - Offline dictionary attack resistance
# - Equal peers: mutual authentication
# WPA3-Enterprise:
# - 192-bit security suite
# - Mandatory PMF (Protected Management Frames)Management Frame Protection (PMF)
PMF (Protected Management Frames / 802.11w) protects deauthentication and disassociation frames from spoofing. Required in WPA3; optional in WPA2. Without PMF, evil twin and deauth DoS attacks are trivial.
WPA2 vs WPA3 Summary Table
Key differences between the protocols in a practical security context.
# Protocol comparison:
# WEP: RC4, broken, never use
# WPA: TKIP, deprecated, avoid
# WPA2: AES-CCMP, secure if strong PSK + enterprise
# WPA3: SAE, forward secrecy, best current standard
# Transition mode: WPA2/WPA3 mixed for compatibilityChecking AP Security Mode
Identify what security protocol an AP is using before testing. Airodump-ng and Wireshark both show the cipher suite in beacon frames.
# Airodump-ng shows encryption column:
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon
# ENCRYPTION column:
# OPN = open (no security)
# WEP = WEP
# WPA2 = WPA2 (check CIPHER for CCMP vs TKIP)
# WPA3 = WPA3 SAEEnterprise Wi-Fi Security
WPA2/WPA3-Enterprise with EAP-TLS (certificate-based) is the most secure configuration. Each user has a unique certificate — no shared secret that can be dictionary-attacked.
Rogue AP and Deauth Attacks
Without PMF, an attacker can: send spoofed deauth frames to disconnect clients, then capture the WPA2 handshake as they reconnect, or lure them to a rogue AP matching the legitimate SSID.
Quick Check
What key security improvement does WPA3 SAE provide over WPA2-PSK?
Summary: Wi-Fi Security Protocols
WEP is irretrievably broken; WPA/TKIP is deprecated; WPA2-AES is secure when paired with strong PSKs and enterprise authentication; WPA3-SAE is the current best standard. Enable PMF on all WPA2 networks. Prefer WPA2/WPA3-Enterprise with EAP-TLS for corporate environments.
Frequently asked questions
Is the “802.11 Security Protocols: WEP, WPA2, WPA3” lesson free?
Yes — the full text of “802.11 Security Protocols: WEP, WPA2, WPA3” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “802.11 Security Protocols: WEP, WPA2, WPA3”?
Understand why WEP was broken, how WPA2 CCMP works, and what WPA3 SAE improves. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “802.11 Security Protocols: WEP, WPA2, WPA3” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- 802.11 Security Protocols: WEP, WPA2, WPA3
- WPA2 Handshake Capture and Cracking
- Evil Twin and Captive Portal Attacks
- Enterprise Wi-Fi: EAP and RADIUS