The first Wi-Fi security protocol, Wired Equivalent Privacy (WEP), had a simple goal: make wireless connections as secure as plugging in an Ethernet cable. It aimed to provide confidentiality by encrypting data sent over the air. To do this, WEP used a stream cipher called RC4 combined with a 24-bit value called an Initialization Vector (IV). The IV was intended to ensure that even if you sent the same data multiple times, the encrypted output would look different each time.

The idea was sound, but the execution was flawed. The biggest problem was the IV itself. At only 24 bits, there are only about 16.7 million possible IVs. On a busy network, these values would inevitably be reused. When the same IV is used with the same key to encrypt different data packets, an attacker can analyze the encrypted traffic and deduce the plaintext. This vulnerability, known as an IV collision, allowed attackers to systematically break WEP's encryption and recover the network key, often in a matter of minutes. The "wired equivalent privacy" was anything but.

The collapse of WEP led to the creation of Wi-Fi Protected Access (WPA) and its more robust successor, WPA2. The first version of WPA introduced the Temporal Key Integrity Protocol (TKIP) as a firmware-upgradable patch for devices that only supported WEP. TKIP was a temporary fix, designed to plug the most immediate holes without requiring new hardware.

The real leap forward came with WPA2, which made support for a much stronger protocol mandatory: AES-CCMP. AES, the Advanced Encryption Standard, is a block cipher trusted by governments and corporations worldwide. It encrypts data in fixed 128-bit blocks, making it far more resistant to the types of analysis that broke WEP's stream cipher. CCMP provides both encryption for confidentiality and an authentication code to ensure the data hasn't been tampered with in transit.

WPA2 primarily uses a Pre-Shared Key (PSK) for authentication on home networks. You and your devices know the password, and the router knows the password. When a new device connects, it engages in a 4-way handshake to prove it knows the key and to generate a unique encryption key for the session. While secure for its time, this handshake had a vulnerability. An attacker could passively capture this handshake and then try to guess the password offline. Using powerful computers, they could test millions of potential passwords per second against the captured data in what's known as an offline dictionary attack.

To address the weaknesses in WPA2, the Wi-Fi Alliance introduced WPA3 in 2018. Its most significant improvement is replacing the PSK handshake with Simultaneous Authentication of Equals (SAE), a more secure method informally known as the Dragonfly Handshake. SAE is resistant to offline dictionary attacks because it doesn't exchange information that an attacker can use to test passwords. Instead, both the client and the access point engage in a cryptographic exchange that proves they both know the password without ever revealing it. An attacker trying to guess the password would have to interact with the access point for every single guess, making brute-force attacks impractical.

Another key feature introduced with WPA3 and SAE is Forward Secrecy. This ensures that even if an attacker manages to capture all your encrypted traffic and later discovers the network password, they still can't decrypt the old data. Each connection session uses a unique, temporary encryption key that is discarded afterward. The master password is only used for authentication, not for ongoing encryption. This compartmentalizes the damage a compromised key can do.

For corporate environments, WPA3-Enterprise offers even higher security, including the option for 192-bit encryption to protect sensitive data. The transition from WPA2 to WPA3 is designed to be gradual, with a transition mode that allows both WPA2 and WPA3 devices to coexist on the same network, easing the upgrade path for organizations and home users alike.

Let's check your understanding of these evolving standards.

Understanding this evolution from the flawed WEP to the robust WPA3 shows a clear progression in cryptographic design. Each new standard was built directly on the lessons learned from the failures of its predecessor, creating the secure wireless connections we rely on today.