I85PREP
⌘ K
CWSR study materials
CWSR study resources

CWSR: WPA, WPA2, WPA3 and Robust Security Networks

CWSR · Work through your exam, one topic at a time.

All guide sections

WPA, WPA2, WPA3 and Robust Security Networks

This domain tests the generational differences between the Wi-Fi security certifications, the cryptography each one mandates, and the failure modes that survive even in current deployments. Questions frequently contrast personal and enterprise modes or ask why a given attack succeeds against one generation and fails against another.

The generations

  • WEP: RC4 with a 24-bit IV and a CRC-32 integrity check over static keys. Broken by FMS and PTW style attacks; never acceptable.
  • WPA: TKIP, adding per-packet key mixing, a sequence counter, and the Michael MIC as a stopgap on legacy hardware. Deprecated.
  • WPA2: the 802.11i Robust Security Network, with CCMP/AES mandatory and 802.11w optional.
  • WPA3: SAE for personal, an optional 192-bit Suite-B mode for enterprise, mandatory PMF, OWE for open networks, and DPP for onboarding.

Personal mode

WPA2-Personal converts an 8 to 63 character passphrase into a 256-bit PMK using PBKDF2-HMAC-SHA1 with 4096 iterations and the SSID as salt. Anyone who captures a 4-way handshake, or just the PMKID from message one, can attack that derivation offline. WPA3-Personal replaces this with SAE, a password-authenticated key exchange in which the password is never transmitted and each session derives a unique key, giving forward secrecy and blocking offline dictionary attack. The Hash-to-Element variant, mandated in WPA3 v3.0 for new certifications, removes weaknesses found in early SAE implementations.

Enterprise mode

WPA2 and WPA3 Enterprise use 802.1X with EAP, giving per-user credentials, per-session keys, and accounting. WPA3-Enterprise 192-bit mode adds GCMP-256, SHA-384, and 384-bit elliptic curves; the default WPA3-Enterprise profile remains 128-bit.

Transition mode

WPA2 and WPA3 mixed mode keeps a WPA2 path available, so an attacker can attempt downgrade and the WPA2 side retains offline-attack exposure. Treat transition as temporary and track the client population until it can be retired.

Worked example

A 12-character passphrase from a 26-letter alphabet has about 9.5 x 10^16 combinations. At one million guesses per second against a captured handshake, that is roughly three thousand years, so the passphrase looks safe. But if it is the company name followed by a year, a rule-based wordlist finds it in minutes. The entropy of the generation process, not the length, is what matters. Recommend at least 20 random characters, or better, migrate to SAE or 802.1X.

Traps that cost marks

  • Claiming SAE eliminates password guessing; it limits online guessing and blocks offline attack, but weak passphrases remain guessable online.
  • Confusing WPA3-Enterprise 192-bit mode with the default WPA3-Enterprise profile.
  • Believing WPA2-Personal provides per-user keys or accountability.
  • Forgetting that PMKID capture enables offline attack without a complete handshake.