Examkin

Question

Difficulty: MediumWireless Security Protocols (WPA, WPA2, WPA3)

A network administrator is transitioning a retail store Wi-Fi network from WPA2-Personal to WPA3-Personal. During testing, the administrator confirms that pre-shared key (PSK) authentication has been replaced by Simultaneous Authentication of Equals (SAE) based on the Dragonfly key exchange algorithm. Which security enhancement does SAE deliver when compared to the traditional WPA2 4-way handshake?

  1. It provides forward secrecy and built-in resistance to offline dictionary attacks even when password complexity is low.Answer
  2. B
    It encrypts the entire packet payload using RADIUS authentication credentials rather than individual pre-shared keys.
  3. C
    It enables access points operating in Local mode to continuously authenticate clients offline when controller connectivity is lost.
  4. D
    It buffers unauthenticated client frames at the access point interface rather than dropping out-of-profile handshake packets.

Answer

SAE provides forward secrecy and prevents offline dictionary attacks by eliminating the predictable 4-way handshake password exchange used in WPA2-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE), replacing the vulnerable 4-way WPA2 PSK exchange. SAE leverages the Dragonfly key exchange protocol, which prevents passive eavesdroppers from capturing traffic and cracking passwords via offline dictionary attacks, while also guaranteeing forward secrecy.

Step-by-Step Solution

1
Analyze WPA2-Personal vulnerability
WPA2-Personal uses a 4-way handshake based on a static PSK. An attacker capturing the handshake can perform offline brute-force or dictionary attacks to reveal the PSK.
The WPA2 pairwise master key (PMK) derivation allows passive offline analysis.
2
Evaluate WPA3-Personal SAE operation
WPA3-Personal replaces the standard PSK 4-way handshake with Simultaneous Authentication of Equals (SAE), based on the Diffie-Hellman Dragonfly key exchange.
SAE executes a peer-to-peer authentication exchange before key establishment.
3
Identify key cryptographic advantages
SAE ensures forward secrecy (session keys cannot be compromised even if the password is discovered later) and renders offline dictionary attacks useless because each attempt requires an active network exchange.
Invalid authentication attempts require live interactions with the AP, frustrating passive capture analysis.

Key Concept

WPA3-Personal Simultaneous Authentication of Equals (SAE)
Rate this question

Topics

Wireless Security Protocols (WPA, WPA2, WPA3)

More questions from this topic