WPA3: The Ultimate Guide

Wi-Fi Protected Access (WPA) has evolved significantly since its inception in 1999. WPA2 replaced the original standard in 2004 and has remained the benchmark for secure wireless networks ever since, in large part because WPA2 with 802.1X authentication has been highly effective against a wide range of attacks.

However, the monetary value of data is continually increasing and drawing more and more people to hacking and data theft. Sophisticated tactics, outdated tech, missing patches, and the ingenuity of people have exposed weaknesses in WPA2’s defense and prompted the creation of WPA3 .

WPA3 is still fairly new and only really used by highly sensitive environments like governments and large corporations. But as more devices and infrastructure are built to accommodate WPA3, it will become more commonly used by smaller organizations.

If you are considering adopting WPA3-Enterprise, check out our blog where we test all the operating systems against enterprise access points, and weigh the costs and benefits so you can learn if it’s right for your organization.

What Is WPA3?

WPA3 (Wi-Fi Protected Access 3) is the third generation of the WPA wireless security certification standard, developed by the Wi-Fi Alliance to address known vulnerabilities in WPA2 — particularly weaknesses in pre-shared key (PSK) authentication and server certificate validation (SCV).

WPA3 introduces Simultaneous Authentication of Equals (SAE) for personal networks, mandates SCV for enterprise networks, and adds support for 192-bit cryptographic security through the Commercial National Security Algorithms (CNSA) suite.

WPA3 certification became available in 2018 and has been required on all Wi-Fi CERTIFIED devices since July 2020.

The Migration From WPA2 to WPA3

Why did the upgrade from WPA2 to WPA3 take 14 years? Because WPA2-Enterprise has been a solid method for protecting your network. Though not without its faults, WPA2 has been the network security standard because it prevents a huge range of attacks, from brute force to man-in-the-middle (MITM) .

It was not until the last couple of years that some WPA2 vulnerabilities were exposed, but even these were not a major detriment to the protocol. Attackers would exploit users with improperly configured devices or security lapses in outdated devices to break into WPA2. If your users are properly configured and your network does not host devices with weak security, WPA2 is highly effective, especially with WPA2-Enterprise.

WPA2 Shortcomings

The main issues with WPA2 stem from WPA2-PSK and how it uses passwords.

To connect to a WPA2-PSK network, users are granted access by obtaining a pre-shared key (PSK) or password. Passwords have been around long enough that more sophisticated hacks can easily bypass any system relying on password security.

Since its release, PSK has been plagued with security vulnerabilities and susceptible to offline dictionary attacks and brute force attacks. Basically, a hacker could keep guessing passwords until they found a match. With enough computing power, an attacker could attempt nearly infinite password combinations.

To combat this, PSKs had to be long and complex strings of digits to make them harder to guess. However, this didn’t account for the human element. Requiring complex PSKs may be more secure, but complicated passwords are easy to forget or mistype. This led many people to write down passwords, defeating the very purpose of security.

WPA3 Adoption and Device Compatibility

Organizations are beginning to offer WPA3 as they refresh access points and as end-user devices gain WPA3 support. The transition timeline varies significantly by organization size, device refresh cycles, and internet of things (IoT) device density.

All major wireless solution providers support WPA3, both in their latest products and in their software releases. But WPA3 compatibility is still limited on end devices, certainly on the hardware level. IoT devices also have to be accounted for, and since they can last for years, the transition to WPA3-exclusive infrastructure will take considerable time. There will be a long transition period during which both WPA2 and WPA3 devices will need to be supported on the same Wi-Fi networks.

Wi-Fi 6 and Wi-Fi 7 Certification

WPA3 is required for Wi-Fi CERTIFIED 6 (Wi-Fi 6) and Wi-Fi 7 devices, which means adoption will accelerate naturally as organizations upgrade to newer Wi-Fi generations. Wi-Fi 6 introduced WPA3 as a mandatory certification requirement, effectively coupling the WPA3 transition with hardware refresh cycles in enterprise environments.

WPA3 vs. WPA2: Key Differences

WPA3 improves on WPA2 across both of its main modes — WPA2-PSK and WPA2-Enterprise — though the scope of change differs significantly between them.

WPA3-SAE

WPA3 replaces PSK with Simultaneous Authentication of Equals. At its core, SAE requires user interaction every time they enter credentials. This small addition is an effective technical control against dictionary attacks.

When an attacker executes a dictionary attack, they will instantaneously send countless software-generated credentials in hopes that one is correct and grants access.SAE establishes a unique key each time the user and server interact; without SAE, a single key is used to establish trust. If an attacker obtains that key, the server trusts each password attempt, and the attacker can send virtually unlimited password attempts. By requiring a new, unique key with each attempt, an attacker can only make one dictionary attack guess at a time, rendering the attack useless.

SAE also provides forward secrecy, meaning that a compromised session key cannot be used to decrypt past or future sessions. This is a significant improvement over WPA2-PSK, where a captured handshake could be used to retroactively decrypt previously recorded traffic.

Another WPA2-PSK issue that will be addressed is eliminating the use of vulnerable legacy protocols. Networking is a combination of countless tools, software, and protocols working together. While each component has a specific task, they work in conjunction towards specific goals; in this case, that goal is protecting the network.

As technology ages, it generally becomes less secure, potentially becoming a weak point in a network’s security. WPA3 will have specific protocols that are acceptable and others that are unacceptable to guarantee stronger overall security.

WPA3-Enterprise

There are far fewer improvements for WPA3-Enterprise because WPA2-Enterprise is still a secure method. It includes the optional use of 192-bit key security, increasing the complexity of keys used.

But the largest improvement is the requirement for server certificate validation when a cloud RADIUS server is used. In the past, organizations sometimes skipped SCV or lacked onboarding tools, which led to users misconfiguring their devices. WPA3-Enterprise addresses this risk by enforcing SCV, since without it, users are highly vulnerable to over-the-air credential theft.

WPA3 and IoT Devices

IoT devices present one of the most significant adoption challenges for WPA3. Many IoT devices have fixed firmware and cannot be updated to support WPA3, meaning organizations with large IoT deployments will need to maintain WPA2 compatibility for the foreseeable future. WPA3 Transition Mode — a mixed-mode configuration supported by most modern access points — allows WPA2 and WPA3 devices to coexist on the same network while newer devices take advantage of WPA3 security improvements.

WPA3 and 802.1X Authentication

WPA2-Enterprise with 802.1X allows admins to choose how they will authenticate network users; either with digital certificates or user credentials.

Certificates can be configured to do many different things, but a key component is how they are used for network security. Once a user has a valid certificate, they are automatically reconnected to the secure network every time. The user never has to enter a password to reconnect, and the certificate cannot be stolen by an outside attacker. If you’d like to learn more about the numerous benefits of certificates, read our overview of certificate-based authentication .

When compared to WPA2-PSK, WPA2-Enterprise is a much more secure network type. Given that there are no credentials, SAE does not apply to WPA2-Enterprise. But for WPA3-Enterprise, new 802.1X upgrades have been developed to improve authentication security.

CNSA

Commercial National Security Algorithms (CNSA) is a configuration developed by the NSA to protect government information and is now a new 802.1X configuration option introduced with WPA3.

CNSA requires specific algorithms that all have about the same level of security. This eliminates potential 802.1X misconfigurations, cipher downgrades, and mix-and-matching algorithms. For now, CNSA is only being used by large enterprises that require strong security measures.

WPA3 Weaknesses and Limitations

WPA3 is a meaningful step forward in wireless security, but it is not without limitations. Understanding these gaps is important for organizations evaluating WPA3 adoption.

• Dragonblood vulnerabilities: Researchers identified side-channel and denial-of-service flaws, known as “Dragonblood,” in the SAE handshake shortly after WPA3’s release. Patches have been issued, but the discovery highlighted that WPA3 is not immune to implementation flaws.
• Transition mode risk: WPA3 Transition Mode, which allows WPA2 and WPA3 clients to coexist, reduces some of the security benefits of WPA3. An attacker may force a WPA3-capable device to downgrade to WPA2.
• IoT and legacy incompatibility: Many IoT and legacy devices do not support WPA3, limiting the feasibility of enforcing WPA3-only environments.
• Implementation complexity: Advanced modes such as CNSA and 192-bit security increase configuration complexity and raise the risk of misconfiguration.

WPA3 and Wi-Fi Enhanced Open

Enhanced Open is an improvement upon public venues that use WPA2-PSK, such as coffee shops, bars, or other public places with Wi-Fi. Many hackers have taken advantage of open networks to eavesdrop on others’ connections and steal personal data.

Wi-Fi Enhanced Open provides Opportunistic Wireless Encryption (OWE) , which basically is an encrypted open network. To the user, nothing has changed — they connect to the open Wi-Fi, accept the rules, and gain Wi-Fi access. Underneath the surface, OWE uses the Diffie-Hellman key exchange, a unique key that is only known by the connecting client and the access point (AP). Since no other party knows the key, eavesdropping on the connection becomes significantly more difficult.

While Wi-Fi Enhanced Open is not technically part of WPA3, they were released at the same time and are likely seen as a complementary pair of network security improvements — one addressing PSK vulnerabilities on private networks, the other addressing eavesdropping on public ones.

Using Digital Certificates With WPA3-Enterprise

Implementing digital certificates used to be difficult and expensive to implement on-premises, but managed public key infrastructure (PKI) services have adequately addressed those issues. PKIs are cheaper to build now than they were a decade ago, and cloud-based options are more affordable and versatile than on-prem options. Organizations looking to reduce certificate management overhead can explore JoinNow Dynamic PKI as an alternative to building and maintaining their own certificate infrastructure.

Server Certificate Validation

Server certificate validation is required with WPA3-Enterprise, which may seem troubling for a lot of network administrators, but it’s actually a good thing.

SCV requires a device to verify the server’s identity before attempting to connect. While many organizations may have ignored it, SCV is actually a significant security improvement because it prevents users from connecting to the wrong server.

In the past, many organizations instructed their users to use the “Do not validate” setting as a workaround to avoid implementing proper Extensible Authentication Protocol (EAP) SCV. However, not validating can put users at risk of leaking their credentials.

Organizations with WPA2-Enterprise have two ways to approach SCV: hiring trained IT staff to configure end-user devices, or deploying a device onboarding service with SCV built in.

Enrolling Devices With Certificates

Managed devices can be easy to configure and enroll with certificates, but the same can’t be said for bring-your-own-device (BYOD) environments because they typically involve the end user. Plus, BYOD policies must cover numerous operating systems (iOS, macOS, Windows, Android), each with its own configuration methods.

The SecureW2 JoinNow MultiOS allows IT teams to push a customizable configuration client with an intuitive self-enrollment wizard that guides the end user through the confusion of configuring their device. End users can download the JoinNow MultiOS app, and after clicking a few buttons, their device is configured for 802.1X and enrolled with a certificate. These certificates can be used to authenticate users for Wi-Fi, remote workers for VPN, and much more.

Is WPA2-Enterprise Still a Good Option?

While the arrival of WPA3 networks was a long-anticipated upgrade that has become more necessary in recent years, WPA2 with 802.1X authentication continues to offer sufficient security for most. However, those who want a highly secure network will certainly benefit from WPA3. The improvements within WPA3 address many of the specific vulnerabilities that have plagued WPA2 in recent years.

For now, WPA3 is primarily used for large organizations with hundreds of thousands of devices to manage. But just because an organization might not be ready for WPA3 doesn’t mean IT teams should cut corners on network security.

SecureW2 has solutions to make your WPA2-Enterprise network as safe as possible. Schedule a demo to see how SecureW2 can harden your WPA2-Enterprise network today.

---

Frequently Asked Questions

What is the difference between WPA2 and WPA3?

WPA3 improves on WPA2 primarily by replacing PSK with Simultaneous Authentication of Equals, which eliminates offline dictionary attacks. WPA3-Enterprise adds mandatory server certificate validation and optional 192-bit security through CNSA. WPA2 remains widely used and is still considered secure, particularly in WPA2-Enterprise configurations with certificates.

Is WPA3 more secure than WPA2?

Yes, WPA3 is more secure than WPA2 in most configurations. SAE eliminates the offline dictionary attack vulnerability of WPA2-PSK, and mandatory server certificate validation in WPA3-Enterprise closes a common configuration gap. That said, WPA2-Enterprise with properly configured 802.1X and certificate-based authentication remains highly effective for most organizations.

Does WPA3 work with older devices?

WPA3 is not backward-compatible at the protocol level, but most modern access points support WPA3 Transition Mode, which allows WPA2 and WPA3 devices to connect to the same network simultaneously. Older devices — particularly IoT hardware — may require WPA2 indefinitely or until hardware is replaced.

What is SAE in WPA3?

Simultaneous Authentication of Equals is the authentication mechanism WPA3 uses to replace WPA2’s pre-shared key. SAE requires a unique key exchange for each connection attempt, preventing attackers from running offline dictionary attacks against captured handshake data. SAE also provides forward secrecy, protecting previously recorded traffic even if a key is later compromised.

When is WPA3 required?

WPA3 has been required for all Wi-Fi CERTIFIED devices since 2020, per Wi-Fi Alliance mandates. Devices certified for Wi-Fi 6 (802.11ax) and Wi-Fi 7 must support WPA3. Government and defense environments that follow NSA CNSA guidelines may require WPA3-Enterprise with 192-bit mode.