A High-Level Analysis of Various Encryption Algorithms Used in Wireless Security
Key Takeaways
- Wi-Fi encryption encodes data and prevents it from unauthorized use.
- The WEP, WPA, WPA2 and WPA3 are some common Wi-fi encryption modes.
- WPA2-Enterprise supports passwordless authentication through digital certificates for a more secure network.
- A managed PKI manages certificates easily, as it offers auto revocation of unused and expired certificates for an added layer of security.
Data encryption encodes data, making it hidden and inaccessible to an unauthorized user.
Encryption is more common than we think. Data is transmitted as ciphertext whenever we access our email or applications, log in to a website, or connect to a VPN. This protects data from an interceptor who could gain access to a network with malicious intent.
Encrypting wireless networks is crucial when connecting to a network or website, as an unsafe or malicious link can lead to data and credential leaks. Wi-Fi Protected Access (WPA), developed by the Wi-Fi Alliance, ensures Wi-Fi security is more effective than its predecessor, Wired Equivalent Privacy (WEP).
Since the late 1990s, multiple iterations of wireless security standards, such as WPA, WPA2, and WPA3, have been used for better encryption and authentication. This article will explain how wireless network data encryption works. It will explore why encryption algorithms are used in wireless security, and how they help safeguard your wireless connections for a more robust and secure network.
What Is Wireless Network Security?
Wireless network security protects wireless computer networks from data breaches and other forms of cyberattack. Wireless network security is a broad term which includes Wi-Fi, Bluetooth, and cellular networks.
Wireless signals travel over the air, which makes them potentially vulnerable to interception. That’s why wireless networks require a different security strategy from wired networks.
A strong wireless security program includes:
- Wireless network data encryption to protect private data
- Authentication protocols to verify users before they join the network
- Access controls to limit what each user and device can do once they are connected to the network
What Is Wireless Encryption and Why Is It Important?
Wireless encryption converts plaintext data into a cipher, so that attackers can’t read it as it travels within a Wi-Fi network.
Since Wi-Fi networks transmit data over the air, attackers can easily intercept that data. Unencrypted data is easy to read and steal, which means that financial data, passwords, and other private information can be exposed.
Wireless encryption adds a strong layer of protection, ensuring that even if hackers intercept your data, they won’t be able to use it.
Understanding Different Wireless Encryption Standards
Wireless networks are commonly encrypted using two main algorithms.
The first is the Stream Cipher, which converts plaintext to ciphertext bit-by-bit. With the Stream cipher, encryption begins with an encryption key fed into the bit generator. It generates an 8-bit keystream, which initiates the encryption process.
The following table illustrates how the different wireless network data encryption standards operate.
|
Encryption Algorithm |
Type of Encryption |
Size of Data Block |
|---|---|---|
|
RC4 |
Stream Cipher |
Nil |
|
RC5 |
Block Cipher |
32/64/128 bits |
|
DES |
Block Cipher |
56 bits |
|
3DES |
Block Cipher |
56 bits |
|
AES |
Block Cipher |
128 bits |
The Block Cipher works on a fixed-size chunk of data with a fixed encryption key and encrypts data in blocks to maximize security. Here are some encryption algorithms used by a wireless network.
In wireless networks, the most commonly encountered encryption algorithms are RC4 and AES. The most prevalent wireless network security standards are WEP, WPA, WPA2, and WPA3.
Wired Equivalent Privacy (WEP)
The Wi-Fi Alliance developed the first encryption type, WEP, the first wireless protocol for authentication and encryption of Wi-Fi networks, based on the RC4 algorithm. WEP encrypts traffic using a 64-bit or a 128-bit key in hexadecimal, wherein all the data going back and forth is encrypted using the same key.
As time passed, the same key usage became a security flaw despite the increase in the key size, and hackers could crack the key using tools in their systems.
Info: WEP was declared obsolete due to security flaws in 2004, but some administrators still use it on their routers, especially for older, unsupported devices.
Wi-Fi Protected Access (WPA)
Wi-Fi Protected Access (WPA) replaced WEP in 2003 and offered significant enhancements for key encryption and user authentication.
WPA uses the Temporal Key Integrity Protocol (TKIP), which changes the key every time a system uses it. TKIP prevents a hacker from using his key to match the system’s key on a secure wireless network. It was eventually succeeded by the Advanced Encryption Standard (AES).
Info: WPA uses the 256-bit key from the 64-bit and 128-bit keys used in WEP, but it is still vulnerable to attacks as it is password-protected.
Wi-Fi Protected Access 2 (WPA2)
WPA2 was introduced in 2004 to address the security flaws present in WPA and has two modes:
- The WPA2-PSK mode, which is suited for home setup and relies on passkeys for authentication.
- The WPA2-Enterprise mode, which supports digital certificates or individualized credentials for users and is suited for organizational use.
WPA2 mainly uses the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), based on the AES algorithm, for robust Wi-Fi security, authentication, and verification.
However, WPA2 is still vulnerable to key reinstallation attacks (KRACK), in which a hacker can pose as a clone network and force a user to connect to a malicious network to steal data and credentials to decrypt the key.
The WPA2-PSK mode protects a Wi-Fi network with a single pre-shared key, which can be stolen or manipulated easily. However, WPA2-Enterprise mode supports digital certificates that are phishing-resistant compared to passwords.
EAP-TLS Process in WPA2- Enterprise Protocol
Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) supports digital certificates for passwordless authentication, offering robust Wi-Fi security compared to passwords and pre-shared keys.
Digital X.509 certificates are phishing-resistant as they cannot be duplicated or stolen. EAP-TLS also uses client-server or mutual authentication, where the client authenticates the server and vice-versa. This makes EAP-TLS the most secure authentication protocol for users and devices on a network.
WPA2-Enterprise enhances Wi-Fi security by supporting EAP-TLS encryption for certificate-based authentication and Cloud RADIUS for mutual authentication.
EAP-TLS reduces the risk of a MITM attack to almost zero due to mutual server authentication and digital certificates. It also enhances the user experience, as a digital certificate can be created once and stays in the system until it is revoked, unlike passwords, which need periodic resets and can lead to disconnects.
Wi-Fi Protected Access 3 (WPA3)
WPA3 is the latest Wi-Fi security protocol, created in 2018, and is technically superior to WPA2.
It uses the Galois/Counter Mode Cipher Block Chaining Message Authentication Code Protocol (GCMP) 256-bit encryption compared to the 128-bit encryption used in WPA2.
WPA3 also addressed the KRACK vulnerability of the WPA2 protocol by patching the four-way handshake with the Simultaneous Authentication of Equals (SAE) feature. SAE transmits the credentials in a one-time message rather than a multi-way conversation, eliminating reusing pre-shared keys.
Info: As of 2020, the Wi-Fi Alliance has mandated the support of WPA3 for all wireless devices seeking wireless support.
This video goes into greater detail about the differences between WPA2-Enterprise and WPA3-Enterprise.
Comparing WEP, WPA, WPA2 and WPA3
- WPA uses the RC4 stream cipher for encryption but is enhanced by TKIP for more secure encryption.
- WEP and WPA use the same encryption algorithm, RC4 encryption
- WPA2 uses the CCMP algorithm for a robust Wi-Fi connection.
- WPA3 uses the AES-CCMP deployed by homes and organizations to protect and encrypt classified data and credentials.
- WPA and WPA2 use the 4-way handshake for Wi-Fi connections, giving rise to the KRACK vulnerability.
The SAE handshake in WPA3 authenticates a device through a one-time conversation to protect a network from attacks. This method properly authenticates a device onto a network to protect connections from being attacked.
Which Wi-Fi Protocol Should You Use for Your Organizational Needs?
If you have unsecured wireless networks, a hacker can easily steal your credentials or data, resulting in loss of goodwill, compliance issues, and millions of dollars in fines. To protect your wireless routers, you should understand the differences between the various security types.
WEP is an obsolete Wi-Fi security type that you should avoid, especially in a business setting. WPA is a stronger form of encryption but is vulnerable to key reinstallation attacks, making it a risky choice for enterprise Wi-Fi security.
WPA3 is a relatively newer protocol that has yet to be widely adopted, as there is little support for it.
WPA2 is a widely used Wi-Fi protocol that supports smartphones, wireless routers, laptops, and IoT devices.
- WPA2-PSK uses pre-shared keys to secure your network and is unsuitable for organizational or business use.
- WPA2-Enterprise uses digital certificates, considered the gold Wi-Fi security standard.
Digital X.509 certificates are phishing-resistant, as they cannot be stolen or duplicated. They are unique to each user and device and are populated with unique attributes for identity context, enabling network administrators to monitor who and what is connecting to their network.
Secure Your Wireless Network With WPA2-Enterprise Authentication
WPA2-Enterprise with certificate-based authentication closes the gaps left permanently open by pre-shared keys.
There are no shared secrets to rotate, no credentials exposed to phishing, and no opportunity for rogue devices to bypass a misconfigured RADIUS policy.
Our JoinNow platform enforces EAP-TLS across your wired and wireless infrastructure, connects RADIUS policy to live IdP and MDM data, and revokes access in seconds when a user offboards.
If your wireless security still depends on passwords or shared keys, that’s the gap worth closing first.
See how SecureW2 secures wireless networks without passwords.
Frequently Asked Questions
What are the encryption methods for wireless networks?
There are three main encryption methods for wireless networks. The oldest, Wired Equivalent Privacy (WEP), is now considered defunct because attackers can easily decipher it. WEP has been replaced by WPA2 (Wi-Fi Protected Access 2), which relies on stronger encryption and is widely used today. The latest encryption standard is WPA3, which introduces additional cryptographic protections.
Is WPA outdated?
Yes. Wi-Fi Protected Access (WPA) is now considered outdated, like its predecessor, WEP. Today, many organizations use WPA2 to encrypt their private data. The latest encryption standard, WPA3, adds additional layers of cryptographic protections.
What is the strongest wireless encryption?
WPA3 is considered the gold standard for wireless encryption. WPA3-Personal is the strongest choice for home networks, and WPA3-Enterprise offers the highest level of protection for organizations.
