WPA3 - Wi-Fi Protected Access 3

2 min readArticle

WPA3 is the current WiFi security standard, replacing WPA2. Introduced in 2018 and mandatory for Wi-Fi CERTIFIED devices since 2020. It addresses several critical weaknesses in WPA2 — most importantly the 4-way handshake that allowed offline dictionary attacks.

Key Improvements Over WPA2

Feature	WPA2	WPA3
Key Exchange	PSK (Pre-Shared Key)	SAE (Simultaneous Authentication of Equals)
Offline dict attacks	Possible (capture handshake)	Not possible (forward secrecy)
PMKID attack	Vulnerable	Not applicable
WPS	Supported	Not supported
Open networks	Unencrypted	OWE (Opportunistic Wireless Encryption)
Enterprise	WPA2-Enterprise	WPA3-Enterprise (192-bit mode)

WPA3 SAE (Dragonfly Handshake)

SAE replaces the 4-way handshake. Key properties:

Both parties prove knowledge of the password without transmitting it
Each session generates unique session keys (forward secrecy)
Capturing the handshake doesn't give you anything to crack offline
PMKID attack doesn't work

WPA3 Attack Surface

Despite improvements, WPA3 has had vulnerabilities:

Dragonblood Attacks (2019)

Discovered by Vanhoef and Ronen — several flaws in the SAE handshake implementation:

Side-channel attacks — timing and cache-based information leakage allowed offline dictionary attacks against weak passwords
Downgrade attacks — push device from WPA3 to WPA2 then use classic attacks
Denial of Service — malformed commit frames could crash APs

Most were patched. Still interesting for understanding where WPA3 has weaknesses.

Downgrade Attack

bash

# Create an evil twin with WPA2 only
# Device may downgrade if it "remembers" network as WPA2
# Then capture WPA2 handshake and crack normally
airbase-ng -e "TargetSSID" -c 6 wlan0mon

Transition Mode Weakness

Many networks run WPA2/WPA3 transition mode for backward compatibility. This can be attacked by targeting the WPA2 side:

bash

# Deauth from WPA3 AP, client may reconnect to your WPA2 evil twin
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon

WPA3-Personal vs Enterprise

WPA3-Personal — SAE replaces PSK, still uses a shared password
WPA3-Enterprise — Uses 802.1X with RADIUS, 192-bit cryptographic suite option

OWE (Enhanced Open)

WPA3 introduced OWE for open networks — provides encryption even on public WiFi without a password. Prevents passive eavesdropping. Doesn't prevent evil twin attacks though.

WPA3 and WPS

WPS is not compatible with WPA3 — if a router is WPA3-only, WPS attacks are off the table. Good.

Current Status

Most modern routers (2020+) support WPA3
Many run WPA2/WPA3 transition mode
If you see WPA3, focus on transition mode or client-side attacks
Client devices need to support WPA3 — older devices force transition mode