27

I know there are three method for wifi security. What are the relative strengths of the password encryption in WEP, WPA and WPA2 PSK?

Gilles 'SO- stop being evil'
  • 50,912
  • 13
  • 120
  • 179
Muhammad Sholihin
  • 383
  • 1
  • 4
  • 8

2 Answers2

40

The schemes you mention are protocols for securing 802.11x traffic over wireless networks. They don't mandate how the AP password is encrypted or hashed during storage. However, the security of the protocol does rely on making the key secure.

  • WEP relies on a broken RC4 implementation and has severe flaws in various aspects of its protocol which make breaking WEP near-trivial. Anyone with a laptop and a $20 wifi antenna can send special de-auth packets, which cause legitimate clients to re-authenticate to the AP. The attacker can then capture the initialization vectors from these re-authentication packets and use them to crack the WEP key in minutes. Due to the severity of the break, WEP is now considered deprecated. See this question for more details on WEP security.
  • WPA improves upon this, by combining RC4 with TKIP, which helps defend against the IV-based attacks found in WEP. It also improves upon the old handshake mechanism, to make it more resistant to de-auth attacks. Whilst this makes a large improvement, vulnerabilities were found in the way that the protocol worked, allowing an attacker to break TKIP keys in about 15-20 minutes. You can read more about the attack at this other question.
  • WPA2 closes holes in WPA, and introduces an enhanced version of TKIP, as well as CCMP. The standard also bring support for AES, which provides even further security benefits. At current there are no known generic attacks against WPA2.
zaphodef
  • 103
  • 3
Polynomial
  • 132,208
  • 43
  • 298
  • 379
  • 1
    Let me add a bit of an intensifier regarding WEP. If you've been thinking about going with WEP, you should probably just go with an unencrypted wireless network instead. That way at least you're not fooling yourself into thinking you're secure. –  Nov 28 '12 at 04:18
  • 4
    WEP is better than *no security at all* in cases where you don't want your neighbours using it, assuming said neighbours aren't the types to know the difference between WEP and WPA. – Polynomial Nov 28 '12 at 06:52
  • Note that TKIP is nowhere near that insecure even now. – Yuhong Bao Dec 21 '16 at 09:13
  • Does this paper mean WPA2 is now broken? https://lirias.kuleuven.be/bitstream/123456789/547640/1/usenix2016-wifi.pdf – CAD97 Oct 16 '17 at 03:54
  • @CAD97, one of the two attacks described is against an implementation error (an access point using a random-number generator that isn't very random). The other is against WPA-TKIP. – Mark Mar 06 '18 at 22:53
  • @Polynomial Perhaps you should update your answer to mention KRACK as well as WPA3. – forest Mar 07 '18 at 02:51
19

Updated answer: Now even WPA2 is broken
The KRACK Attack can breaks WPA2 WiFi protocol.
Router, access point, WiFi client need to be patched.

More info here:
https://www.krackattacks.com/
https://www.bleepingcomputer.com/news/security/new-krack-attack-breaks-wpa2-wifi-protocol/

Old answer here:
The short answer is that WPA2 is the only secure protocol.

But it's secure only if WPS (WiFi Protected Setup) on the access point is disabled.
WPS is broken, an access point with WPS enabled is crackable, no matter what kind of WiFi protocol it uses.

For more info: How to crack a WPS enabled WiFi network

Sadly, WPS is enabled by default on the majority of WiFi Router and Access Point...
The first thing I do on any router I put my hand on, is disabling WPS.

Max
  • 342
  • 2
  • 8
  • 1
    This is misleading. KRACK Attacks are not a flaw in the protocol but a vulnerability in the implementation of the hostap daemon. Even more, not all devices are affected and it has been patched AFAIK – Mr. E Mar 06 '18 at 16:42
  • @Mr.E to my knowledge "both the client and AP must be patched to defend against all attacks" [link](https://security.stackexchange.com/a/171358/7272) so the 'it has been patched' only apply to the very few people that know how to, and care about, keeping Firewall/router/AP + smartphone/computer/client updated. Sorry if my wording is not correct, do you think it's better if I say "The KRACK Attack can breaks your WiFi WPA2 security on many devices."? – Max Mar 06 '18 at 22:54
  • 3
    @Mr.E Actually, it is a flaw in the protocol. Any _perfectly compliant_ WPA2 implementation will be vulnerable to KRACK. Luckily however, it is possible to mitigate it with a small change to the protocol that does not break backwards compatibility. This means that patched systems are no longer perfectly compliant, but they are still compatible with truly compliant implementations. – forest Mar 07 '18 at 02:52