2

It is well known that (malicious) endpoints in a Wi-Fi network password-protected by WPA2-Personal can sniff all clear traffic to/from any other endpoint, if they can also capture the 4-way handshake of each connecting device. That information allows them to derive the per-connection link key of other users.

Is that still the case with WPA3-Personal (which doesn't use the same handshake)?

A well-advertised property of WPA3-Personal is that it makes password brute-forcing unfeasible, however in the scenario above, the attacker already knows the password.

SquareRootOfTwentyThree
  • 670
  • 5
  • 12
  • No. As with the password protections, WPA3's expanded encryption for public networks also keeps Wi-Fi users safe from a vulnerability they may not realize exists in the first place. Therefore they are even in public WIFIs protected from other users because they get an own Link key. Anyway WPA3 doesn't use a unsecure 4WHS. They use a Simultaneous Authentication of Equals handshake, which protects the 4WHS with a asymetric encryption. – Cyberduck Dec 12 '18 at 08:52
  • [This question](https://security.stackexchange.com/q/177236/165253) might be of some help. – forest Dec 12 '18 at 09:21
  • 1
    I believe, if the attacker has the password, they can mount a MITM attack. – forest Dec 12 '18 at 09:29
  • @forest no it's not possible in WPA3. That's the main difference. every device get's it's own link key. – Cyberduck Dec 12 '18 at 09:35
  • @CDRohling Ah, so it's only possible when using OWE? How could that be if a malicious device can do an evil twin attack with the correct password? – forest Dec 12 '18 at 09:36
  • @forest yea that's true. That's why WPA3 will also help to secure open Wifis – Cyberduck Dec 12 '18 at 09:38

0 Answers0