Wireless Security Protocols and Authentication Methods
Unit 4: Security Concepts. Lesson 15 of 41 in APlus Academy Core 2.
Wireless security has two halves: the encryption that scrambles the air, and the authentication that decides who may join. The exam asks which protocol to choose and which authentication server does what.
Protocols and encryption
- WEP: the original, broken in minutes; never use it (it appears only as a wrong answer).
- WPA with TKIP: an emergency fix for WEP hardware; TKIP (Temporal Key Integrity Protocol) is now deprecated and weak. If a router offers TKIP, choose AES instead.
- WPA2 with AES: the standard since 2004. AES (Advanced Encryption Standard) in CCMP mode; strong encryption. Two modes: Personal (a pre-shared key everyone types) and Enterprise (802.1X with per-user credentials against a RADIUS server).
- WPA3: the current best. SAE (Simultaneous Authentication of Equals) replaces the pre-shared key handshake so captured traffic cannot be brute-forced offline; forward secrecy protects past sessions if the password leaks later; protected management frames stop deauthentication attacks; Enterprise adds a 192-bit mode; Enhanced Open encrypts guest networks without a password.
Choose WPA3 when every device supports it, WPA2-AES otherwise, and a mixed WPA2/WPA3 transition mode while migrating. TKIP and WEP are never correct.
Authentication methods
Personal networks authenticate with a shared passphrase, which is the same for everyone and impossible to revoke for one person. Enterprise networks authenticate each user or device.
- RADIUS (Remote Authentication Dial-In User Service): the central authentication server for Wi-Fi (802.1X), VPNs, and network devices. The access point forwards the user's credentials to RADIUS, which checks them against the directory and answers accept or reject. Uses UDP ports 1812 (authentication) and 1813 (accounting); encrypts only the password field of its messages.
- TACACS+ (Terminal Access Controller Access-Control System Plus): Cisco's protocol for authenticating administrators to network devices (switches, routers, firewalls). TCP port 49; encrypts the entire packet; separates authentication, authorization, and accounting so it can control which commands an admin may run.
- Kerberos: the ticket-based authentication inside Active Directory domains. The client proves itself once to the Key Distribution Center on the domain controller, receives a ticket-granting ticket, and uses service tickets to reach servers without resending the password. Depends on synchronized clocks (a skew over about five minutes breaks it) and on DNS.
- Multifactor: adding a second factor (token, app, certificate) to any of the above; enterprise Wi-Fi often uses a device certificate plus the user's login.
How enterprise Wi-Fi joins
- The laptop associates with the SSID and is asked for credentials (802.1X, EAP).
- The access point relays them to the RADIUS server.
- RADIUS checks Active Directory (or its own database) and returns accept, often with a VLAN assignment.
- The AP opens the port; encryption keys are unique to that session.
A user who cannot join enterprise Wi-Fi while others can has a credential, certificate, or account problem; when nobody can join, the RADIUS server or its certificate is down.
Wireless Security Protocols and Authentication Methods, explained slowly
What each protocol actually changed
WEP used a small static key and a flawed cipher setup; a few minutes of captured traffic reveal the key. WPA kept WEP hardware alive by wrapping the same cipher in TKIP, which rotates keys per packet; it was always meant to be temporary and is now breakable. WPA2 moved to AES with CCMP, a modern block cipher with integrity checking; its weakness is the pre-shared key handshake, which an attacker can capture and brute-force offline if the passphrase is weak. WPA3 replaced that handshake with SAE (also called Dragonfly), where each side proves knowledge of the password without ever sending material that can be brute-forced offline, and each session gets a fresh key (forward secrecy).
protocol cipher key handling status WEP RC4 (broken) static key never use WPA RC4 + TKIP per-packet rotation deprecated WPA2 AES-CCMP PSK or 802.1X acceptable with a strong passphrase WPA3 AES-GCMP SAE or 802.1X current standard
Personal versus Enterprise
Personal (PSK) means one passphrase shared by every device; anyone who leaves the company still knows it, and one leaked passphrase exposes everyone. Enterprise uses 802.1X: the client presents its own credentials (username and password or a certificate) through EAP, the access point forwards them to a RADIUS server, and each client receives a unique session key. Revoking one user is a directory change, not a passphrase change on every device.
RADIUS, TACACS+, Kerberos side by side
protocol typical use transport encryption AAA handling RADIUS Wi-Fi, VPN, network access users UDP 1812/1813 password field only authentication and authorization combined TACACS+ admin login to routers, switches TCP 49 entire packet separate, per-command authorization Kerberos Windows domain sign-on TCP/UDP 88 tickets, no password on the wire authentication with tickets
Kerberos walkthrough
- The user signs in; the client sends a request to the Key Distribution Center on the domain controller.
- The KDC returns a ticket-granting ticket, encrypted so only a client holding the user's password hash can open it.
- To reach a file server the client presents the TGT and asks for a service ticket for that server.
- The client gives the service ticket to the file server, which trusts it because the KDC signed it.
- Tickets carry timestamps; a clock more than five minutes off the domain controller causes authentication failures, which is why "time drift" is a troubleshooting symptom in the next unit.
Worked scenarios
- A small office router offers WPA2-TKIP, WPA2-AES, and WPA2/WPA3 mixed. Choose mixed if any device lacks WPA3, otherwise WPA3; never TKIP.
- Nobody can join the corporate SSID, but the guest network works. The RADIUS server (or its certificate) is the common element; check it before touching access points.
- Administrators want to log which commands each engineer runs on the switches. TACACS+.
- Domain users cannot log in after a PC sat unplugged for months. Its clock drifted past the Kerberos tolerance; sync time.
How the exam asks it
"Which wireless protocol uses SAE?" (WPA3). "Which encryption should be avoided?" (TKIP or WEP). "Which server authenticates users connecting to enterprise Wi-Fi?" (RADIUS). "Which protocol encrypts the entire authentication packet and is used for device administration?" (TACACS+). "Which authentication protocol uses tickets and requires time synchronization?" (Kerberos).
What to memorize
WPA3 with SAE best; WPA2 with AES acceptable; TKIP and WEP wrong. RADIUS UDP 1812 and 1813, password-only encryption, users. TACACS+ TCP 49, full encryption, device admins. Kerberos tickets from the KDC, five-minute clock tolerance. Multifactor adds a token or certificate on top.