Slashdot Mirror
Wi-Fi Alliance Launches WPA3 Security Standard (securityweek.com)
wiredmikey writes: The Wi-Fi Alliance, the organization responsible for maintaining Wi-Fi technology, announced the launch of the WPA3 security standard. The latest version of the Wi-Fi Protected Access (WPA) protocol brings significant improvements in terms of authentication and data protection.
WPA3 has two modes of operation: Personal and Enterprise. WPA3-Personal's key features include enhanced protection against offline dictionary attacks and password guessing attempts. WPA3-Enterprise provides 192-bit encryption for extra security, improved network resiliency, and greater consistency when it comes to the deployment of cryptographic tools.
WPA3 has two modes of operation: Personal and Enterprise. WPA3-Personal's key features include enhanced protection against offline dictionary attacks and password guessing attempts. WPA3-Enterprise provides 192-bit encryption for extra security, improved network resiliency, and greater consistency when it comes to the deployment of cryptographic tools.
Too bad, my submission has been rejected even though it had a lot more information which I'll post anyways:
New security features include:
Source
WEP sank into the swamp
So we built WPA on top of it and it sank into the swamp
Then we build WPA2 on top of it and it caught fire and sank into the swamp
But WPA3.. WPA3 will stand the test of time!
Is this something a router/access point running OpenWRT could upgrade to? Or would WPA3 require a driver/firmware upgrade as well?
Why are there separate Personal and Enterprise ones?
continuing the bs... It should be as good as it can be... no need for half arsed Personal version
- one year after it's been CrAcKeD!
Most of this is incremental security improvements, as for most users, WPA2 is still sufficiently secure. However, the big deal here is the opportunistic encryption that will encrypt connections that don't require authentication. That's a big deal.
I like to leave my WiFi open for guests, but I have to set up a separate network in order to keep my regular use encrypted. Once everything supports opportunistic encryption, I can just have one network. That's not particularly important.
Where this matters is public WiFi. Many stores have free WiFi with no password. Often they have a login after you connect (annoying, but a separate issue), but there is no encryption on the link. Anyone who knows what they're doing can see every packet you send. When this technology becomes widespread, it will become a bit harder for evesdroppers.
Of course, using public WiFi, you should be using end-to-end encryption on anything important. This is pretty much standard these days for most things, but too often something slips through.
I understand that WPA Enterprise is built off existing technologies but holy fuck setting up it's infrastructure should not be like pulling teeth.
If someone could figure out a way to create an easy to implement, reasonable cost WPA enterprise-as-a-service they would literally print fucking money. Bonus if you could tie it in to an SSO service.
Knowledge of the pre-shared key in personal mode no longer give an attacker the opportunity to decrypt everything on the network. In WPA and WPA2, an attacker who knows the PSK (for example that of a public hotspot) can passively record the handshake frames and recover the keys used by other clients. WPA3 prevents this, so even when you use a public hotspot, the connections between your computer and the access point are secure against passive attacks. (An attacker can still perform a MITM attack because there is no way to authenticate a public hotspot with a non-secret PSK.)
I showed up, but the professor was late. So we all went home.
If you are a Windows shop, there was a really easy to use article on how to set that up with MS services maybe 10 years back. I'll try to find it and reply back if I do.
http://techgenix.com/setting-up-wi-fi-authentication-windows-server-2008-part2/
This isn't the one I was thinking of, but its similar.
Hope this helps.
There should be just one mode of operation the enterprise one. And why 192 bit?
Always use a VPN with wifi, period.
We've learned that the WiFi-Alliance doesn't have the sharpest people and our information is too valuable to trust to people like that.
These new standards will like just mean new ways for attacks to find issues.
Use a VPN.
WPA3 is resistant to dictionary attacks. The Wi-Fi Alliance says that WPA3's SAE is resistant to offline dictionary attacks where an attacker tries to guess a Wi-Fi network's password by trying various passwords in a quick succession.
WPA3 uses Dragonfly which was shown to be vulnerable to small subgroups that can be exploited to conduct offline dictionary attack.
https://en.wikipedia.org/wiki/...
RFC 7664 section 4 even provides optional advice for mitigation.
Amazing to see new security protocols out of the gate include crypto known to be flawed.
The WiFi Alliance are traitors to freedom and should be hung or shot for their global beyrayal and traitorous actions against liberty and security.
They did, it's called FreeRADIUS.
The only thing missing is a Wizard to set up the server, and a easy way of getting the certs installed on endpoint machines.
Smart devices work perfectly fine. Just install the cert and go.
Windows needs GP to do this without seeing windows' ugly side. A.K.A. Non-descriptive Dialog boxes and random GUI widgets need to be set correctly.
Most linux distros are crap as NetworkManager loves trying to install the certs as per-user certs, and mandates that any keys be password protected with the password stored in the user's keyring. (Which if they have access to the physical storage media, putting a password on the file isn't going to do jack, but network manager's devs refuse to realize this...) The alternative is to manually configure WPA supplicant's config file assuming you can do so, as many distros don't include it anymore as it's auto configured via DBUS from NM.
Chromebooks require a convoluted set up that has a PKI only signing a cert request made on the individual device. That is to say the Chromebook generates a CSR and then submits it to a signing server to create the cert it will use to connect, it will then use that cert until it expires after which it will generate a brand new CSR and key because we can't allow more than one signing attempt by the TPM generated and sealed private key. Also did I mention you have to write the extension for Chrome to be able to do this? And Deploy it via an enterprise policy set in GSuite? No you can't just install the extension from the Chrome Store, it has to be pushed via forced install otherwise it lacks the permissions needed to access the TPM to generate the CSR. BTW, You can't use your own pre-made certs. Why? Well that would give too much power to an Admin and they just couldn't handle it. Heck an Admin wouldn't know what to do with such power! You had best thank the Chrome developers for being such generous handholders and giving Their guidance to you on this huge ordeal.
So it's not so much the server as it is the clients that need the most help. My greatest recommendation would be to fire the existing developers and get some competent people in there to fix the mess.
I also understand that WPA3 will get forward secrecy, and sessions will negotiate a temporary ("ephemeral") key for symmetric cryptography (assuming AES).
Should the traffic be recorded, it cannot be decrypted later if the password is broken.
now that they have that IoT quick join thing, I have a feeling we'll see something similar to the WPS attacks again...