Wi-Fi security: WPA2, WPA3 and what actually protects you

WPA2-Personal lets anyone in radio range capture one handshake and then guess your password offline, indefinitely, without touching the router again. WPA3-Personal removes that artifact: its SAE handshake makes every guess cost a live exchange the access point can throttle or refuse. The catch is the mixed WPA2/WPA3 mode most routers ship, which hands the offline attack back.

What WPA2-Personal gives away

The session key comes from the shared password by way of a 4-way handshake, the EAPOL frames a device exchanges when it joins or re-associates. That exchange is the whole prize, as Aircrack-ng's tutorial says flatly: "The only thing that does give the information to start an attack is the handshake between client and AP."

Nobody has to wait for one. Monitor mode, plus a deauthentication frame if no client obliges, makes a connected device reassociate and repeat the handshake on cue. The router is then out of the loop, and no lockout applies: there is nothing left to talk to. The tutorial's "50 to 300 possible keys per second" is a March 2010 CPU figure that GPUs left far behind.

This is design, not a bug. RFC 7664, the November 2015 IRTF document specifying the Dragonfly exchange SAE is built on, names the failure mode it was written to escape: exchanging password-derived data as proof of knowledge opens a protocol "up to an offline dictionary attack where the attacker gleans enough knowledge from either an active or passive attack on the protocol to run through a pool of potential passwords."

KRACK was a different problem, and WPA3 is not its fix

Two WPA2 stories get blurred together. KRACK, disclosed in October 2017 by Mathy Vanhoef, attacks the key installation step inside the 4-way handshake, forcing nonce reuse so traffic can be decrypted. It is not a password attack: it "works against personal and enterprise Wi-Fi networks, against the older WPA and the latest WPA2 standard, and even against networks that only use AES." Ten CVEs were assigned between CVE-2017-13077 and CVE-2017-13088, a range with gaps. Backward-compatible patches shipped in 2017, before WPA3 existed, so crediting WPA3 with the fix reverses history.

What SAE changes

WPA3-Personal replaces the pre-shared key exchange with Simultaneous Authentication of Equals. The pairwise master key is no longer derived from the password, so a captured handshake holds nothing worth grinding against a word list.

RFC 7664 puts it carefully: resistance to dictionary attack "means that any advantage an adversary can gain must be directly related to the number of interactions she makes with an honest protocol participant and not through computation." The same document grants that an adversary may still "determine the password through repeated brute-force, active, guessing attacks." Guessing just goes online, one attempt per live exchange, which an access point can rate-limit.

Mechanically, SAE runs as authentication algorithm 3 with four frames (two Commit, two Confirm), uses AKM suite selector 00-0F-AC:8, or 00-0F-AC:9 with Fast Transition, needs minimum ECDH group 19 support for interoperability, and makes Protected Management Frames mandatory, which the Wi-Fi Alliance requires of every WPA3 network. Wi-Fi 7 adds Personal AKMs 24 and 25.

Personal and Enterprise are not two grades of the same thing

Personal means one passphrase shared by everyone. Enterprise means 802.1X/EAP against a RADIUS server, individual credentials, and no shared passphrase: a different deployment, not a security slider.

At its standard tier, WPA3-Enterprise uses the same core AKMs, 3 and 5, as WPA2-Enterprise, and the change is mandatory Protected Management Frames. The 192-bit suite everyone quotes is a separate tier, announced in January 2018 as "aligned with the Commercial National Security Algorithm (CNSA) Suite" for networks with "higher security requirements such as government, defense, and industrial." A WPA3-Enterprise SSID gives you no 192-bit anything by default.

Transition mode is where the guarantee stops

In April 2019 Mathy Vanhoef and Eyal Ronen published Dragonblood. The finding that matters at home concerns transition mode, where one SSID serves WPA2 and WPA3 clients with the same password. An attacker can stand up a rogue WPA2-only network using that SSID and force WPA3-capable clients onto it, capturing a partial WPA2 handshake that falls to an ordinary dictionary attack. "No man-in-the-middle position is required to perform this attack." CERT tracks it as VU#871675, and the verdict reads literally: "unless our downgrade attack is mitigated, WPA3 will not prevent dictionary attacks."

Implementation flaws made it worse. The Samsung Galaxy S10 and the iNet Wireless Daemon could be forced onto WPA2 even on a WPA3-only SSID, and Dragonblood found side channels in SAE itself: CVE-2019-9494 (April 17, 2019) covers timing and cache-access leaks in hostapd and wpa_supplicant up to version 2.7, and version 2.8 closed that round but not CVE-2019-13377 (August 15, 2019), a Brainpool-curve timing leak affecting 2.x through 2.8. The researchers costed a brute-force run against the largest known dictionaries at "as little as $1 worth of Amazon EC2 instances."

Every Dragonblood attack targets WPA3-Personal, not Enterprise, and the researchers still said switch: "If vendors don't come up with a better variant of WPA3, then you should switch to WPA3 once it is available." So if every device you need supports WPA3, set that SSID to WPA3 only and give the stragglers their own.

There are three WPA3-Personal deployment modes now, not two

Compatibility mode, built on the IEEE RSN Override mechanism, exists because legacy clients often mishandle an RSN element advertising several AKM and cipher suites at once. Those failures are why residential Wi-Fi providers resist pushing transition mode to home users. If an old printer or camera drops off the day you enable WPA3, that element is the first suspect, not the password. Most WPA3 clients still lack RSN Override, so they can land on WPA2 anyway.

Adoption is lower than the coverage suggests. Statistics from HPE-Juniper, relayed in a WLPC 2026 session, put WPA3 at around 10 percent of Wi-Fi authentications and WPA3-Personal at about 1 percent of those. One vendor's fleet, one talk, not a census.

Apple's recommended-settings page puts it plainly: "Set to WPA3 Personal for better security, or set to WPA2/WPA3 Transitional for compatibility with older devices." Its avoid list: WPA/WPA2 mixed modes, WPA Personal, every WEP variant, and any setting with TKIP in the name.

6 GHz does not offer you the choice

WPA2 is not permitted in 6 GHz operation. Wi-Fi 6E and Wi-Fi 7 devices there require WPA3, Protected Management Frames are mandatory in that band, and the WPA3 details ride in the RSN element itself rather than an override. Both generations also require Hash-to-Element, the replacement for SAE's original hunting-and-pecking password derivation that the side-channel work targeted. Cisco Meraki documents these rules and an engineer confirms them from packet captures; the Wi-Fi Alliance's public pages do not say so in those words.

A device that joins your 5 GHz SSID but refuses the 6 GHz one usually has a WPA3 problem, not a radio problem. Check its WPA3 support before moving antennas.

Turn WPS off

CERT VU#723755, published December 27, 2011 and credited to Stefan Viehböck, describes it: the WPS external registrar method reveals through EAP-NACK responses whether the first half of the 8-digit PIN is correct, and the last digit is only a checksum. The search space collapses from 10^8 to 10^4 + 10^3, "which is 11,000 attempts in total," and many routers implement no lockout at all. CERT offers no real fix, only a workaround: "We are currently unaware of a practical solution to this problem." Disable WPS, or at least its external registrar feature. NVD carries it as CVE-2011-5053; nine vendors are listed as affected, Belkin, Cisco, Netgear and TP-Link among them.

A lockout policy is not the answer either. Pixie Dust, discovered by Dominique Bongard in summer 2014, exploits routers with low or non-existent entropy in their WPS nonces and recovers the PIN offline from a captured exchange, "in only a matter of seconds or minutes, depending on the target, if vulnerable." An attempt counter has nothing to count.

Routers label the PIN method as external registrar, router PIN, or simply WPS; where one switch covers all of it, turn that off. The Wi-Fi Alliance's own WPS page still sells the feature purely as setup convenience and names no weakness.

Guest encryption and guest isolation are two different settings

A password on the guest SSID protects traffic between each device and the access point. It does nothing about what those devices can reach on each other. That job belongs to wireless client isolation, "a security feature that prevents wireless clients from communicating with one another" in Cisco Meraki's words: a separate toggle, frequently off by default even on a network the router labels "guest."

The mechanism matters because of how it fails. Once a client on such an SSID finishes DHCP, the access point tracks the default gateway's MAC address and permits it in "a layer 2 firewall that restricts all other traffic to and from the wireless client." A device on a static IP never completes DHCP, so Meraki says it "will not be able to pass meaningful traffic." It looks connected and moves nothing. Apple's advice on lease length is worth copying too: one hour for guest and hotspot networks, against eight hours for the home network.