Wi-Fi Security: WEP, WPA2, WPA3 Protocols Guide

Why Wi-Fi Protocol Choice Matters

When you connect to a Wi-Fi network, everything you send over that network — web pages, passwords, messages, files — travels as radio waves through the air. Without encryption, anyone within range with a wireless adapter and free software can intercept and read that traffic. Wi-Fi security protocols determine whether that data is protected and how strongly.

The evolution from WEP to WPA3 represents nearly 30 years of cryptographic development, driven largely by the discovery that the previous standard was broken.

WEP: Wired Equivalent Privacy (1997–2004)

Status: Broken. Do not use.

WEP was the original Wi-Fi encryption standard, designed in 1997. Its goal was to provide security equivalent to a wired network. It failed catastrophically at this goal.

WEP uses RC4 stream cipher with a 40-bit or 104-bit key, combined with a 24-bit initialization vector (IV). The IV is the fatal flaw: it is only 24 bits long, meaning it repeats frequently on busy networks. When IVs repeat, statistical analysis of the ciphertext reveals the key.

In 2001, researchers published an attack that recovers the WEP key by collecting enough packets — a process that takes minutes with modern tools. FMS and subsequent attacks made WEP completely useless. Tools like Aircrack-ng can crack WEP in under five minutes on a modern laptop.

If you see WEP as an option on a router, it is a sign the router is very old. Replace the router.

WPA: Wi-Fi Protected Access (2003–2004)

Status: Weak. Avoid if possible.

WPA was a rapid emergency response to WEP's collapse, designed to run on existing hardware. It used the Temporal Key Integrity Protocol (TKIP), which addressed the IV reuse problem by dynamically changing keys per packet.

TKIP was a stopgap. It retained RC4 as the underlying cipher and was designed to be backward compatible with WEP hardware. This heritage brought weaknesses. The TKIP Michael message integrity check was vulnerable to attacks that allowed injection of short packets. WPA with TKIP was deprecated in 2012 and should not be used.

WPA also came in two versions:

• WPA-Personal (WPA-PSK): uses a shared passphrase
• WPA-Enterprise: uses a RADIUS server for per-user authentication

WPA2: Wi-Fi Protected Access 2 (2004–present)

Status: Secure if configured correctly. Still widely used and acceptable.

WPA2 replaced TKIP with AES-CCMP (Advanced Encryption Standard in Counter Mode with CBC-MAC Protocol). AES is a strong, well-studied block cipher. WPA2-AES has no practical cryptographic weaknesses — the encryption itself remains solid.

WPA2 vulnerabilities are implementation and protocol issues:

KRACK (Key Reinstallation Attack, 2017)

Researchers discovered that the WPA2 four-way handshake — the process by which a device and access point negotiate encryption keys — could be manipulated to reinstall an already-in-use key, resetting nonces and replay counters. This allowed decryption of traffic and, in some implementations, traffic injection.

Patches were released for all major platforms. If you applied security updates in 2017 or later, your devices are protected. The attack requires the attacker to be in radio range.

PMKID Attack (2018)

A new technique allows offline brute-force attacks against WPA2-PSK without capturing the four-way handshake — only the PMKID field from a single frame is needed. This makes dictionary attacks against weak passwords much faster.

Implication: if your WPA2 passphrase is a dictionary word, a name, or a simple phrase, it can be cracked offline. Use a random passphrase of 15+ characters.

WPA2 Best Practices

• Use WPA2-AES only; disable TKIP and WEP compatibility modes
• Set a passphrase of at least 15 random characters (not a word or phrase)
• For businesses, use WPA2-Enterprise with per-user credentials
• Keep router firmware updated

WPA3: Wi-Fi Protected Access 3 (2018–present)

Status: Current standard. Use it if your hardware supports it.

WPA3 was finalized in 2018 and mandated for Wi-Fi CERTIFIED devices in 2020. It addresses the core weaknesses of WPA2:

Simultaneous Authentication of Equals (SAE)

WPA3-Personal replaces the PSK handshake with SAE, also known as Dragonfly. SAE provides forward secrecy: even if an attacker records your encrypted traffic today and later obtains your password, they cannot decrypt the old traffic. Each session uses a unique derived key.

SAE also eliminates offline dictionary attacks — the protocol requires interaction with the access point to guess passwords, making brute force impractically slow.

Enhanced Open (OWE)

WPA3 includes Opportunistic Wireless Encryption for open networks. Coffee shop Wi-Fi can now encrypt traffic without a password, preventing passive eavesdropping between clients even on a public network.

192-bit Security Suite

WPA3-Enterprise adds an optional 192-bit security mode using AES-256 and SHA-384, appropriate for organizations handling sensitive data.

WPA3 Transition Mode

Most modern routers support WPA3 alongside WPA2 in transition mode. WPA3-capable devices use WPA3; older devices fall back to WPA2. This allows gradual migration without cutting off older hardware.

What to Configure on Your Router Today

1. Log into your router admin panel (typically 192.168.1.1 or 192.168.0.1)
2. Navigate to wireless security settings
3. Choose WPA3 if available, or WPA2/WPA3 transition mode
4. Disable WEP and WPA/TKIP modes explicitly
5. Set a strong passphrase: at least 15 random characters, not a word or phrase — something like thunder-pine-47-circuit
6. Update your router firmware: check the manufacturer's site or the admin panel for updates
7. Disable WPS (Wi-Fi Protected Setup): it has known vulnerabilities and should be off

A Quick Reference

Protocol	Year	Cipher	Verdict
WEP	1997	RC4	Broken — never use
WPA/TKIP	2003	RC4	Deprecated — avoid
WPA2-AES	2004	AES-128	Acceptable with strong password
WPA3-SAE	2018	AES-128/256	Current best practice

Protocol strength matters less than you might expect if your password is weak. WPA3 with a weak passphrase is still vulnerable to physical-proximity attacks. Start with a strong password and then enable the strongest protocol your devices support.