This week, the team behind Wi-Fi—the people who insist the name is hy-phen-a-ted—have started certifying products supporting WPA3.
It’s more secure, less hackable, and will even protect the open network at your local coffee shop. Those, at least, are the claims of the Wi-Fi Alliance.
Yep, it’s time to buy all new equipment again. In this week’s Security Blogwatch, we worry about budgets.
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Leyden jars …
WPA3 FTW
What’s the craic? Curtis Franklin Jr. writes darkly—WPA3 Brings New Authentication and Encryption to Wi-Fi:
WPA3 is the latest version of Wi-Fi Protected Access, a suite of protocols and technologies that provide authentication and encryption for Wi-Fi. [It] is now available for inclusion in products. It brings two deployment models, personal and enterprise, along with a related security set called Easy Connect.
…
The primary enhancement … is in the authentication process. [It] makes brute-force dictionary attacks much more difficult and time-consuming [making] attacks that depend on cloud-based server farms and automated key attempts unavailable to attackers.
…
WPA3 Enterprise provides 192-bit encryption. … Both WPA3 flavors disallow certain previous encryption algorithms while still providing a path for transition to the new standard.
…
IoT devices get their own new security with Easy Connect. [It] allows a device with a rich user interface to [enroll] devices with no UI. For example, a … phone can be used to bring Web cams onto the network. [And] devices can be batch-introduced to the network.
About time, amirite? Roland Moore-Colyer agrees—It’s been a long time coming:
WiFi is finally getting its largest security upgrade in over a decade. [WPA3] will replace the WPA2 security protocol. Go figure.
…
One interesting addition is "forward secrecy" which the WiFi Alliance … noted will prevent older data from being accessed even if an encrypted WiFi transmission is intercepted … and cracked. Older data will remain secured and hackers will only be able to glimpse at the data flowing across the network at the time; not great, but a lot better than seeing a hacker with access to historical data.
…
[But] WPA3 will take some time, if not another decade, before it rolls out across all the billions of WiFi-enabled devices.
Okay, but how does it work, doc? Mathy Vanhoef, PhD, discusses the Technical Details:
Personal networks, in other words ordinary home networks that are protected with a single password, will be required to use the Simultaneous Authentication of Equals (SAE) handshake. … This handshake is resistant against offline dictionary attacks. … Since in practice many networks use weak passwords, resistance against this attack is a major improvement.
…
Nevertheless … if the handshake is not carefully implemented, it is vulnerable to side-channel attacks. [And] the access point (AP) must store the password in plaintext … meaning if someone gains access to the AP they can read out the plaintext password.
…
The SAE handshake is a variant of the Dragonfly handshake defined in RFC 7664, which in turn is based on the SPEKE handshake. In [WPA3] the SAE handshake negotiates a fresh Pairwise Master Key (PMK) [which] is then used in a traditional 4-way handshake to generate session keys.
…
WPA3 offers … increased key sizes. More specifically … AES-GCM with 256-bit keys for encryption, and elliptic curve cryptography based 384-bit curves. Additionally, SHA384 of the SHA2 family will be used, and any employed RSA keys must be at least 3072 bits in size. All combined, this results in 192-bit security … roughly.
…
It's also interesting to note that … new WPA2-certified devices are now required to support … Protected Management Frames (PMF). … This prevents deauthentication attacks.
However, there’s a fly in the ointment. مختصری a.k.a. @lowk3y spots it:
Ok, we "have" WPA3, but when will vendors upgrade its firmware/drivers/etc on APs as well as supplicants/clients so we can actually use it??
So Chris Hoffman asks, When Will I Get It On My Wi-Fi?:
In a few years, when the laundry folding robots and smart fridges are forgotten, WPA3 will be everywhere making it harder for people to hack your Wi-Fi. … The WPA2 standard has served us well, but it’s getting a little long long in the tooth. It debuted in 2004, fourteen years ago.
…
Technically, WPA2 and WPA3 are hardware certifications that device manufacturers must apply for. A device manufacturer must fully implement the required security features before being able to market their device as “Wi-Fi CERTIFIED™ WPA2™” or “Wi-Fi CERTIFIED™ WPA3™”. … So you’ll likely start seeing this logo on new routers and other wireless devices beginning in late 2018.
…
We don’t expect that many [existing] devices will receive software or firmware updates to support WPA3. Device manufacturers could theoretically create software updates that add these features to existing … devices, but they’d have to go through the trouble of applying for and receiving WPA3 certification. … Most manufacturers will likely spend their resources on developing new hardware devices instead.
…
Even when WPA3 is widespread, expect a long transition period where some devices are connecting to your router with WPA2 and others … with WPA3.
“B-but Father, I don’t want any of that.” Get wise to the_skywise’s tale: [You’re fired—Ed.]
She has huuuuge tracts of land.
WEP sank into the swamp
So we built WPA on top of it and it sank into the swamp
Then we build WPA2 on top of it and it caught fire and sank into the swamp
But WPA3... WPA3 will stand the test of time!
And the hexadecimally pseudonymous fb39ca4 quips:
And then won't be used when your smart fridge that's supposed to last another 10 years only supports WPA2.
Anyway, does WPA3 fix the open-Wi-Fi privacy problem? Brian Barratt brings good news, everyone—The next generations of Wi-Fi security will save you from yourself:
It’s not just safe; it’s impossible to screw up … with Wi-Fi Enhanced Open. … With WPA2, anyone on the same public network as you can observe your activity, and target you with intrusions. … On WPA3? Not so much.
When you log onto a coffee shop’s WPA3 Wi-Fi with a WPA3 device, your connection will automatically be encrypted without the need for additional credentials. It does so using an established standard called Opportunistic Wireless Encryption.
…
WPA3's expanded encryption for public networks also keeps Wi-Fi users safe from a vulnerability they may not realize exists in the first place.
But why are there still two separate profiles—Personal and Enterprise? This Anonymous Coward follows the money:
One OBVIOUSLY costs more and is OBVIOUSLY better.
Meanwhile, anonymous this coward is:
Always two there are. Master and apprentice, personal and enterprise. Dark things come in twos.
The moral of the story?
Better start planning for a new network kit. Or if you’re choosing equipment right now, get vendors' assurances for a WPA3 upgrade path.
And finally …
You have been reading Security Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites … so you don’t have to. Hate mail may be directed to @RiCHi or sbw@richi.uk. Ask your doctor before reading. Your mileage may vary. E&OE.
Image source: mista stagga lee (cc:by)
Keep learning
Get up to speed on unstructured data security with TechBeacon's Guide. Plus: Get the Forrester Wave for Unstructured Data Security Flatforms, Q2 2021.
Join this discussion about how to break the Ground Hog Day repetition with better data management capabilities.
Learn how to accelerate your analytics securely into the cloud in this Webinar.
Find out more about cloud security and privacy, and selecting the right encryption and key management in TechBeacon's Guide.
Learn to appreciate the art of data protection and go behind the privacy shield in this Webinar.
Dive into the new laws with TechBeacon's guide to GDPR and CCPA.
