DataTerminology.comNEW
Also known as: WEP
A deprecated Wi‐Fi security algorithm with RC4 and initialization vector weaknesses that allow practical key recovery.
DESCRIPTION
Wired Equivalent Privacy (WEP) was the original 802.11 mechanism intended to provide confidentiality comparable to wired networks. Due to weak key scheduling with RC4 and short, reused initialization vectors, WEP is vulnerable to rapid key recovery attacks. Practical tools can crack WEP within minutes, leading to its deprecation and replacement by WPA and later WPA2. Modern networks must disable WEP entirely to avoid exposure and compliance issues. Legacy hardware lacking WPA2/3 support should be retired or isolated. WEP remains an instructive case study in cryptographic design pitfalls.
ALTERNATIVE DEFINITIONS
Wikipedia
Wired Equivalent Privacy (WEP) is a security algorithm for IEEE 802.11 wireless networks.
Provides the baseline definition and scope within 802.11.
NIST SP 800-153
WEP has well-known security vulnerabilities and should not be used to protect sensitive information.
Authoritative guidance explicitly deprecating WEP for sensitive use.
RELATED TERMS
Wi-Fi Encryption WPA2 IEEE 802.11 RC4 Initialization Vector Temporal Key Integrity Protocol Counter Mode with CBC-MAC Passive Attack Replay Attack
COMPETING TERMS
RELATIONS
- Broader: Privacy
KNOWLEDGE AREAS
Data Security Infrastructure Data Privacy & Compliance
TARGET AUDIENCE
Security Architect Cybersecurity Engineer IT Manager Application Administrator Chief Information Security Officer
EXTERNAL SOURCES
- Wikipedia - Wired Equivalent Privacy
- Cisco - Guidance on migrating from WEP to WPA2
- US-CERT - Advisory on wireless security weaknesses
TOP QUESTIONS
Why is Wired Equivalent Privacy considered insecure?
Design flaws in RC4 key scheduling and short, reused IVs enable practical key recovery. Attackers can decrypt traffic and hijack sessions quickly.
Category: Risk
When was Wired Equivalent Privacy deprecated?
WEP was effectively deprecated after WPA’s introduction in 2003 and WPA2’s ratification with 802.11i in 2004, and it is now widely prohibited by policy.
Category: History
What replaced Wired Equivalent Privacy?
WPA and later WPA2 replaced WEP, introducing stronger encryption and authentication mechanisms like TKIP and AES-CCMP.
Category: Alternatives
Can WEP ever be acceptable today?
No. Security and compliance standards uniformly advise disabling WEP; segment and retire legacy devices that require it.
Category: Opinion
What is the biggest misunderstanding about Wired Equivalent Privacy?
Some assume long WEP keys are safe; however, structural weaknesses make even longer keys vulnerable to fast attacks.
Category: Misunderstanding
What attacks target Wired Equivalent Privacy?
Statistical attacks on RC4 using IV collisions enable rapid key recovery; replay and packet injection are also common.
Category: Example
How should organizations migrate away from WEP?
Adopt WPA2/3, replace incompatible hardware, and enforce policies blocking legacy associations. Monitor for rogue WEP SSIDs.
Category: Management
What compliance risks come from using WEP?
Use of WEP can violate regulatory and contractual security requirements, risking audit findings and potential breaches.
Category: Risk
What lesson does WEP teach about cryptography?
Protocol design and key management matter as much as cipher choice; misuse of RC4 and IV design doomed WEP.
Category: Insight