CTS 229: Introduction to WPA3

In this episode, we are providing an introduction to WPA3. We also show how to configure it on a Cisco controller as well as how you could validate it by looking at Wi-Fi frames:













Introduction



WPA3 is the improved version of Wi-Fi security. It updates WPA2 which is commonly used everywhere in Wi-Fi networks. 



Why the need for WPA3?



* KRACK Attack* https://www.cleartosend.net/cts-094-sealing-krack-attack/* WPA2-PSK is subject to dictionary attacks



WPA3 brings the following:



* Increased crypto strength* Dumps legacy protocols* Mandates Protected Management Frames (PMF)* https://www.cleartosend.net/802-11w-management-frame-protection/* Mandatory for Wi-Fi 6 (more and more devices will support WPA3)



There are two versions of WPA3 which are similarly named from WPA2:



* WPA3-Personal* Pre-shared Key* Simultaneous Authentication of Equals (SAE) is used* WPA3-Enterprise* Builds upon WPA2-Enterprise* Enhanced encryption* WPA3-Enterprise also offers an optional mode using 192-bit minimum-strength security protocols and cryptographic tools to better protect sensitive data:* Authenticated encryption: 256-bit Galois/Counter Mode Protocol (GCMP-256)* Key derivation and confirmation: 384-bit Hashed Message Authentication Mode (HMAC) with Secure Hash Algorithm (HMAC-SHA384)* Key establishment and authentication: Elliptic Curve Diffie-Hellman (ECDH) exchange and Elliptic Curve Digital Signature Algorithm (ECDSA) using a 384-bit elliptic curve* Robust management frame protection: 256-bit Broadcast/Multicast Integrity Protocol Galois Message Authentication Code (BIP-GMAC-256)







WPA3 Modes



There are a few modes WPA3 can be implemented



* WPA3-Personal only* WPA3-Personal transition* WPA3-Enterprise only* WPA3-Enterprise transition* WPA3-Enterprise 192-bit* WPA3 Fast BSS Transition* WPA3-Enterprise Server Certificate Validation



WPA3-Personal



* Mandatory* AP enables at least AKM suite selector of 00-0F-AC:8 (SAE Authentication)* STA allows at least AKM 00-0F-AC:8 for association* AP and STA must use PMF* AP and STA sets MFPC and MFPR to 1* Must use only DH groups 15-21, group 19* Requirement* AP and STA does not enable AKM 00-0F-AC:2 (WPA2-PSK) and 00-0F-AC:6 (PSK using SHA-256)* AP doesn’t enable WPA on same BSS with WPA3-Personal* No WEP and TKIP on same BSS as WPA3-Personal* STA will use SAE when AP supports SAE and PSK



WPA3-Personal Transition



* Mandatory* AP enables at least AKM 00-0F-AC:2 (WPA2-PSK) and 00-0F-AC:8 (WPA3-Personal)* STA allows at least AKM 00-0F-AC:2 (WPA2-PSK) and 00-0F-AC:8* AP sets MFPC to 1, MFPR to 0* STA sets MFPC to 1, MFPR to 0* AP rejects association for SAE if PMF is not negotiated* STA negotiates PMF when associating to AP using SAE* Recommended* AP enables AKM 00-0F-AC:6* STA allows 00-0F-AC:6* Requirement* AP doesn’t enable WPA on same BSS with WPA3-Personal* No WEP and TKIP on same BSS as WPA3-Personal* STA will use SAE when AP supports SAE and PSK



WPA3-Enterprise Only



* PMF will be set to capable which is the MFPC bit set to 1 and MFPR bit set to 1 in the RSN Capabilities field* No WPA version 1 enabled on the same BSS on WPA3-Enterprise



WPA3-Enterprise transition mode



* WPA2-Enterprise and WPA3-Enterprise transition mode on same BSS, PMF will be set to capable which is the MFPC bit set to 1 and MFPR bit set to 0 in the RSN Capabili...