Security

Wi-Fi® is an integral part of daily life. Billions of people the world over depend on Wi-Fi in their homes and businesses, to shop, bank, coordinate life, and stay connected. Securing Wi-Fi connections is an important element of securing personal data, and Wi-Fi Alliance® has been on the forefront of evolving Wi-Fi security as the number of Wi-Fi devices in use worldwide has grown.

Since 2003, Wi-Fi Alliance has enabled individuals and businesses to increase the protection of information moving across Wi-Fi networks through the Wi-Fi Protected Access® family of technologies. Security features of Wi-Fi Protected Access constantly evolve to include stronger protections and new security practices as the security landscape changes.

The Wi-Fi Protected Access security family includes solutions for personal and enterprise networks.

Wi-Fi CERTIFIED WPA3™

WPA3™ provides cutting-edge security protocols to the market. Building on the widespread success and adoption of Wi-Fi security, WPA3 adds new features to simplify Wi-Fi security, enable more robust authentication, deliver increased cryptographic strength for highly sensitive data markets, and maintain resiliency of mission critical networks. All WPA3 networks:

  • Use the latest security methods
  • Disallow outdated legacy protocols
  • Require use of Protected Management Frames (PMF)

Since Wi-Fi networks differ in usage purpose and security needs, WPA3 includes additional capabilities specifically for personal and enterprise networks. Users of WPA3-Personal receive increased protections from password guessing attempts, while WPA3-Enterprise users can now take advantage of higher-grade security protocols for sensitive data networks.

WPA3 is a mandatory certification for Wi-Fi CERTIFIED™ devices.

WPA3-Personal

WPA3-Personal brings better protections to individual users by providing more robust password-based authentication, even when users choose passwords that fall short of typical complexity recommendations. This capability is enabled through Simultaneous Authentication of Equals (SAE). The technology is resistant to offline dictionary attacks where an adversary attempts to determine a network password by trying possible passwords without further network interaction. 

  • Natural password selection: Allows users to choose passwords that are easier to remember
  • Ease of use: Delivers enhanced protections with no change to the way users connect to a network
  • Forward secrecy: Protects data traffic even if a password is compromised after the data was transmitted

WPA3-Enterprise

WPA3-Enterprise builds upon the foundation of WPA2-Enterprise with the additional requirement of using Protected Management Frames on all WPA3 connections.

  • Authentication: multiple Extensible Authentication Protocol (EAP) methods
  • Authenticated encryption: minimum 128-bit Advanced Encryption Standard Counter Mode with Cipher Block Chaining Message Authentication (AES-CCMP 128)
  • Key derivation and confirmation: minimum 256-bit Hashed Message Authentication Mode (HMAC) with Secure Hash Algorithm (HMAC-SHA256)
  • Robust management frame protection: minimum 128-bit Broadcast/Multicast Integrity Protocol Cipher-based Message Authentication Code (BIP-CMAC-128)

WPA3-Enterprise with 192-bit mode

WPA3-Enterprise also offers an optional mode using 192-bit minimum-strength security protocols and cryptographic tools to better protect sensitive data.

  • Authentication: Extensible Authentication Protocol – Transport Layer Security (EAP-TLS) using Elliptic Curve Diffie-Hellman (ECDH) exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) using a 384-bit elliptic curve
  • Authenticated encryption: 256-bit Galois/Counter Mode Protocol (GCMP-256)
  • Key derivation and confirmation: 384-bit Hashed Message Authentication Mode (HMAC) with Secure Hash Algorithm (HMAC-SHA384)
  • Robust management frame protection: 256-bit Broadcast/Multicast Integrity Protocol Galois Message Authentication Code (BIP-GMAC-256)

The 192-bit security mode offered by WPA3-Enterprise ensures the right combination of cryptographic tools are used and sets a consistent baseline of security within a WPA3 network.

Open Wi-Fi networks

Users access Wi-Fi networks everywhere: at home, in the office, in hotels, shopping malls, transportation hubs, and municipal locations. Accessing unsecured networks in these locations presents a risk that someone could acquire personal data, which is why Wi-Fi Alliance highly recommends users ensure they access secure, authenticated networks whenever possible. However, there are situations where an open Wi-Fi network is the only feasible option. While many consumers worldwide utilize open networks with no issue, it is important to be aware of the risk an open network presents, and to be diligent in protecting user data. To address these risks, Wi-Fi Alliance has developed a solution to benefit users of open Wi-Fi networks.

Wi‑Fi CERTIFIED Enhanced Open™ is a Wi-Fi Alliance certification that preserves the convenience open networks offer while reducing some of the risks associated with accessing an unsecured network. Wi-Fi Enhanced Open™ networks provide unauthenticated data encryption to users, an improvement over traditional open networks with no protections at all. These protections are transparent to the user. Based on Opportunistic Wireless Encryption (OWE) defined in the Internet Engineering Task Force (IETF) RFC8110 specification and the Wi‑Fi Alliance Opportunistic Wireless Encryption Specification, Wi-Fi Enhanced Open benefits users by providing data encryption that maintains the ease of use of open networks, and benefits network providers because there are no public passphrases to maintain, share, or manage.

Because Wi-Fi Enhanced Open is a Wi-Fi CERTIFIED™ program, the technology is interoperable with legacy networks, even those using a captive portal. Network operators wishing to deploy a fully-featured authentication and device-provisioning solution should consider approaches such as Wi‑Fi CERTIFIED Passpoint®.

Vulnerability Reporting

Security Development

Video

Wi-Fi Alliance News See All

The Beacon Blog See All

The Signal Podcast See All

Product Finder

Additional Resources

Frequently Asked Questions

What are “legacy protocols”?

Other legacy protocols are earlier generations of Wi-Fi security, which have been updated or replaced over time due to the changing security landscape needs. The original security standard was Wired Equivalent Privacy (WEP). It was replaced by the original Wi-Fi Protected Access (WPA) in 2003 as an interim solution to the limited protection offered by WEP. The WPA program added support for Temporal Key Integrity Protocol (TKIP) encryption, an older form of security technology with some vulnerability to cryptographic attacks. WPA was replaced in 2004 with more advanced protocols of WPA2.

Though the threat of a security compromise is small, users should not purchase new equipment which supports only WPA with TKIP. Only devices supporting WPA3 security should be purchased and used.

What are Protected Management Frames?

Protected Management Frames (PMF) provide protection for unicast and multicast management action frames. Unicast management action frames are protected from both eavesdropping and forging, and multicast management action frames are protected from forging. They augment privacy protections already in place for data frames with mechanisms to improve the resiliency of mission-critical networks. PMF is required for all new certified devices.

What does “security” mean in the context of Wi-Fi?

In the context of Wi-Fi technology, security means two things. First, controlling who can connect to and configure your network and equipment. Second, it means securing the data travelling wirelessly across your Wi-Fi network from unauthorized view.

Wi-Fi security is just one aspect of security for networks. A protected Wi-Fi network is a great start, but you should also consider measures to protect your computer (virus software, firewall, etc.) and your communications across the internet virtual private network (VPN), etc.

What security measures should I take when working away from my home?

Configure Wi-Fi client devices (laptops, handsets, and other Wi-Fi enabled products) to enable security protections.

Configure for approved connections: Many devices are set by default to sense and automatically connect to any available wireless signal. Wi-Fi Alliance recommends that you configure your device to not automatically connect to an open network without your approval.

Disable sharing: Wi-Fi enabled devices may automatically enable themselves to sharing / connecting with other devices when attaching to a wireless network. File and printer sharing may be common in business and home networks, but this should be avoided in a public network such as a hotel, restaurant, or airport hotspot.

Users may also wish to use complementary security measures to improve the security of their activity over the internet including virtual private networks (VPNs), firewalls, etc.

Are Wi-Fi CERTIFIED products protected by security?

As of July 1, 2020, all new Wi-Fi CERTIFIED devices require WPA3. The only way to be sure that a product meets the latest security standards is to purchase only Wi-Fi CERTIFIED products.

Wi-Fi Alliance Member Publications

Browse All Topics