html

WEP (Wired Equivalent Privacy) is fundamentally broken due to its weak RC4 encryption and static key reuse. Attackers can passively sniff traffic and crack keys using tools like aircrack-ng within minutes. For example:

# Example: Capturing WEP packets
airodump-ng --bssid [AP_MAC] --channel [CH] --write output_file wlan0mon

WPA/WPA2-PSK uses a 4-way handshake to derive unique per-client temporal keys (PTK). However, the pre-shared key (PSK) remains the weakest link:

# Capturing handshake with aireplay-ng
aireplay-ng --deauth 4 -a [AP_MAC] -c [CLIENT_MAC] wlan0mon
# Bruteforcing with hashcat
hashcat -m 2500 handshake.cap wordlist.txt

WPA2-Enterprise (802.1X) uses RADIUS authentication with dynamic keys. Each client negotiates a unique Pairwise Master Key (PMK) via EAP (e.g., EAP-TLS). Here's a minimal OpenSSL snippet for certificate generation:

openssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr
openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt

Broadcast frames use a Group Temporal Key (GTK), derived from the GMK (Group Master Key), encrypted individually per client using their PTK. This ensures all clients receive the same data securely.

• Always prefer WPA3 (OWE for open networks)
• For WPA2, enforce AES-CCMP (avoid TKIP)
• Use 802.1X with EAP-TLS for certificate-based auth
• Monitor for rogue APs with airodump-ng

WEP (Wired Equivalent Privacy) is fundamentally broken due to its weak RC4 encryption and static key usage. Attackers can:

• Capture packets and recover keys using tools like aircrack-ng
• Exploit IV (Initialization Vector) collisions
• Perform packet injection attacks

# Example WEP cracking command
aircrack-ng -a 1 -b 00:11:22:33:44:55 capture_file.cap

While WPA/WPA2 improved security with TKIP (WPA) and CCMP (WPA2), PSK implementations create attack vectors:

• The 4-way handshake can be captured using tools like tshark
• Offline brute-force attacks against weak passphrases
• Rainbow table attacks with tools like hashcat

# Capture WPA handshake with tshark
tshark -i wlan0mon -Y "eapol" -w wpa_handshake.pcap

WPA2-Enterprise using 802.1X authentication provides stronger protection:

• Uses EAP (Extensible Authentication Protocol) framework
• Supports multiple authentication methods (PEAP, TLS, TTLS)
• Generates unique session keys per client

# Example FreeRADIUS configuration for WPA2-Enterprise
authorize {
    preprocess
    chap
    mschap
    digest
    suffix
    eap {
        ok = return
    }
    files
}

The key hierarchy in WPA2 involves multiple layers of key derivation:

1. Pairwise Master Key (PMK) - derived from PSK or EAP
2. Pairwise Transient Key (PTK) - derived from PMK + nonces
3. Group Temporal Key (GTK) - used for broadcast/multicast

WPA2 handles broadcast traffic through:

• Group Temporal Key (GTK) - shared among all clients
• Periodic GTK rotation (configurable on AP)
• Separate encryption from unicast traffic

For robust security, consider:

• WPA3's Simultaneous Authentication of Equals (SAE)
• OWE (Opportunistic Wireless Encryption) for open networks
• Certificate-based authentication with 802.1X

# Example wpa_supplicant config for certificate auth
network={
    ssid="secure-corp"
    key_mgmt=WPA-EAP
    eap=TLS
    identity="user@domain.com"
    ca_cert="/etc/certs/ca.pem"
    client_cert="/etc/certs/client.pem"
    private_key="/etc/certs/client.key"
}