How Does WPA Close the Wi-Fi Security Gap?

by Ken Burnside
While modern wireless encryption is very good, don't neglect physical security.


Thomas Northcut/Photodisc/Getty Images

Networking over Wi-Fi is inherently less secure than networking via Ethernet cable. Because Wi-Fi involves radio transmission, and because it’s typically easier to tap into radio transmissions than cable transmissions, a Wi-Fi network requires its own type of security to address the security gap. The current standard of choice for securing Wi-Fi through encryption is called Wi-Fi Protected Access (WPA). While it's possible (and in some cases, reasonable) to provide unencrypted Wi-Fi access as a home user, for business use, your wireless network should always be encrypted with the best standard available.

WPA Encryption

WPA uses the U.S. government’s most rigorous Advanced Encryption Standard, AES 256, as its encryption base. AES 256 uses a pair of symmetric 256-bit keys. Breaking AES 256 encryption by brute force (trying every permutation of keys possible) is something that can reasonably take longer than the current age of the universe. So much of the electronic economy relies on AES 256 encryption for protection that a known exploit might actually shut down international trade, so this is arguably the most secure standard available.

Prior Encryption Standards

There were two prior encryption standards used in routers: Wired Equivalent Privacy (WEP) and Wi-Fi Protected Access (WPA, later renamed WPS). WEP proved to be trivially easy to break, and was replaced by WPA in 2004. In 2011, WPS proved to have a flaw that allowed it to be cracked in a matter of hours.

Additional WPA Security Features

WPA, in addition to using a stronger encryption algorithm than previous standards, also uses a Temporal Key Integrity Protocol (TKIP) check. TKIP requires that all data packets arrive in sequential order, and each packet has a counter indicating its place in the broadcast sequence. This helps detect and prevent man-in-the-middle and spoofing exploits, where someone grabs and rebroadcasts data flowing over the network in an attempt to extract the encryption key, or grabs data and sends false data in an attempt to authenticate with the router.

Authentication Under WPA

WPA's third encryption benefit is that every WPA client has a unique ID that requires a two-way "handshake" for authentication. This protocol, called Extensible Authentication Protocol (EAP) over 802.1x, prevents any device from getting full access to the network until full bilateral authentication has been completed.

Physical Security

If your business relies on a Wi-Fi network, don't forget physical security. Anyone who can gain access to an Ethernet port may be able to roam your network at will, even if they can't connect wirelessly. With access to the physical router itself, someone wishing to do harm could reset the router and disable Wi-Fi security; or, if the router has a USB port, someone might be able to plug in a “sniffer” program using a portable hard drive. Although these aren’t examples of wireless security per se, keep them in mind; many people who obsess over Wi-Fi security don’t even think about restricting access to the actual networking hardware.

About the Author

Ken Burnside has been writing freelance since 1990, contributing to publications as diverse as "Pyramid" and "Training & Simulations Journal." A Microsoft MVP in Excel, he holds a Bachelor of Arts in English from the University of Alaska. He won the Origins Award for Attack Vector: Tactical, a board game about space combat.

Photo Credits

  • Thomas Northcut/Photodisc/Getty Images
Suggest an Article Correction