Wireless Security Settings — Flashcards

1. Confidentiality: Encrypt wireless frames so intercepted traffic cannot be read by unauthorized parties.

2. Authentication: Verify the identity of devices and users before granting network access — prevent unauthorized connections.

3. Integrity: Detect whether frames have been modified in transit — implemented via a Message Integrity Check (MIC) on each frame. WPA3 provides MIC through GMAC (part of GCMP).

WPA2 PSK's four-way handshake transmits a hash derived from the pre-shared key and a nonce. An attacker passively captures this handshake and performs offline brute-force — guessing passphrases at GPU speeds with no rate limiting, no lockout, and no network interaction required after capture.

This cannot be fixed within WPA2 because transmitting the hash is fundamental to how the four-way handshake establishes the session key. The fix required a new handshake mechanism — SAE in WPA3, which derives the session key via Diffie-Hellman and never transmits the hash at all.

Additionally, WPA2 PSK has no forward secrecy: compromise of the PSK exposes all previously captured sessions.

The encryption and integrity algorithm used in WPA3. GCMP combines two functions in a single algorithm:

• AES encryption (Counter Mode): provides data confidentiality
• GMAC (Galois Message Authentication Code): provides the Message Integrity Check (MIC) — detects frame tampering

Having both confidentiality and integrity in one efficient algorithm is an improvement over WPA2's CCMP. GCMP is stronger and more computationally efficient, benefiting both security and battery life on mobile devices.

The authentication handshake used in WPA3-Personal, replacing WPA2's four-way handshake. SAE is based on Diffie-Hellman key derivation:

• Both client and AP independently derive the session key from the passphrase — the key is never transmitted
• Both sides prove knowledge of the passphrase without revealing it — mutual authentication
• Each connection generates a unique session key — enables forward secrecy
• No hash is transmitted across the network — no offline brute-force possible

Also called the dragonfly handshake in IEEE 802.11 standards. Eliminates the root cause of WPA2 PSK's crackability.

Forward secrecy means that compromise of a long-term secret (the passphrase) does not expose previously recorded encrypted sessions.

WPA2 PSK lacks it: All WPA2 sessions derive their encryption keys from the same static PSK. An attacker who records encrypted sessions and later obtains the PSK can derive all session keys retroactively and decrypt all recorded traffic.

WPA3 provides it: SAE generates a unique session key for every connection via Diffie-Hellman. That session key is derived independently by both sides and never stored or transmitted. Once the session ends, the key is gone. Even if the passphrase is later compromised, there are no session keys to recover — each session's key is independently derived and ephemeral.

Open System: No authentication, no encryption. Used for intentionally public access (hotels, airports). Users must rely on HTTPS and VPN for protection.

WPA3-Personal (PSK): Shared 256-bit passphrase; SAE protects the handshake. Appropriate for homes, small offices without RADIUS infrastructure. All users share one key — no per-user audit trails or individual revocation.

WPA3-Enterprise (802.1X): Individual authentication through RADIUS. Each user has unique credentials. Supports per-user access control, VLAN assignment, audit logging, and individual revocation. Required for corporate environments with accountability requirements. Needs RADIUS infrastructure.

A security framework controlling network access through four steps:

Identification: User presents an identity (username). A claim, not proof.

Authentication: User proves the claimed identity (password, certificate, MFA). RADIUS validates against a directory.

Authorization: System determines what the authenticated user is allowed to access. RADIUS returns attributes: VLAN assignment, permitted resources, bandwidth limits, session time.

Accounting: System records what the user did — login time, logout time, duration, data volume. Creates the audit trail for compliance, billing, and anomaly detection.

Remote Authentication Dial-In User Service — the most widely deployed AAA protocol. A centralized authentication server used by WPA3-Enterprise wireless, VPN gateways, switch consoles, and other network access devices.

RADIUS receives authentication requests from network devices (APs, switches, VPN concentrators), validates credentials against a directory (AD, LDAP), and returns Access-Accept or Access-Reject — optionally including authorization attributes (VLAN, session limits).

Operational security benefit: credentials are stored once; revoking a user's access in AD immediately blocks that user across all RADIUS-integrated systems — no individual device reconfiguration required.

An IEEE standard that blocks all network access at a port until successful authentication. Three roles:

• Supplicant — client device; presents credentials
• Authenticator — AP or switch; enforces access control; relays EAP messages; does NOT validate credentials
• Authentication Server — RADIUS; validates credentials; returns Access-Accept/Reject

Works on both wired (physical switch ports) and wireless (logical 802.11 association). Integrates with RADIUS, LDAP, and TACACS+. EAP is the authentication framework running within 802.1X.

The Authentication Server (RADIUS) validates credentials — not the authenticator.

The Authenticator (the AP or switch) is a policy enforcement point. It:
• Blocks all traffic until it receives an Access-Accept from the authentication server
• Passes EAP messages between the supplicant and the authentication server (relay function)
• Opens the port when Access-Accept arrives; keeps it blocked on Access-Reject

The authenticator does NOT inspect, validate, or make decisions about credentials — it simply enforces what the RADIUS server decides. This distinction — that the AP is an enforcer, not a validator — is frequently tested on the exam.