🔒WPA2

NEW

Also known as: Wi‐Fi Protected Access II

A Wi‐Fi security standard that uses AES‐based CCMP and supports 802.1X enterprise authentication.

DESCRIPTION

WPA2, standardized via IEEE 802.11i, became the dominant Wi‑Fi security baseline for over a decade. It replaces TKIP with AES‑CCMP, providing robust confidentiality and integrity. WPA2‑Enterprise uses 802.1X/EAP with RADIUS for scalable, per‑user authentication. WPA2‑PSK secures home and small office networks with strong passphrases. Vulnerabilities like KRACK highlighted the need for correct implementations and patches. While still widely deployed, WPA2 is gradually being supplanted by WPA3, particularly in high‑risk environments.

ALTERNATIVE DEFINITIONS

Wikipedia

Wi‑Fi Protected Access II (WPA2) is a security protocol and security certification program developed by the Wi‑Fi Alliance to secure wireless computer networks.

Positions WPA2 as both protocol and certification program replacing WPA/TKIP.

Source

Wi‑Fi Alliance

WPA2 delivers strong security through mandatory support of AES‑CCMP.

Highlights the mandatory AES‑CCMP cipher suite in WPA2.

Source

RELATED TERMS

Wi-Fi Encryption IEEE 802.11i Counter Mode with CBC-MAC Extensible Authentication Protocol Remote Authentication Dial-In User Service Pre-Shared Key Enterprise Authentication Opportunistic Wireless Encryption

COMPETING TERMS

WPA3 Wi-Fi Protected Access

KNOWLEDGE AREAS

Data Security Infrastructure Data Privacy & Compliance

TARGET AUDIENCE

Security Architect Cybersecurity Engineer IT Manager Application Administrator Chief Information Security Officer

EXTERNAL SOURCES

• Wikipedia - Wi-Fi Protected Access#WPA2
• NIST SP 800-153 - Best practices for securing 802.11 including WPA2
• CERT/CC - KRACK vulnerability advisory for WPA2

TOP QUESTIONS

Why did WPA2 become the standard for so long?

It mandated AES‑CCMP and 802.1X support, delivering strong, practical security and wide vendor adoption, making it the de facto baseline.

Category: Relevancy

What’s the biggest misunderstanding about WPA2?

That WPA2 is unbreakable; in reality, weak PSKs, WPS misuse, and implementation flaws like KRACK can expose networks.

Category: Misunderstanding

How does WPA2‑Enterprise differ from WPA2‑PSK?

Enterprise uses 802.1X with per‑user credentials and certificates, while PSK uses a shared passphrase for all users.

Category: Comparison

What are common mistakes with WPA2?

Using short PSKs, enabling TKIP for legacy support, and neglecting certificate validation in EAP lead to avoidable risk.

Category: Mistakes

What vulnerabilities affected WPA2?

KRACK exploited key reinstallation, highlighting the importance of patching clients and APs to fix handshake issues.

Category: Risk

How to transition from WPA2 to WPA3?

Enable transition modes, update firmware, ensure client support, and gradually enforce WPA3‑only policies as legacy devices are replaced.

Category: Management

Is WPA2 still acceptable?

Yes in many contexts, but high‑security environments should prioritize WPA3, especially for public and sensitive networks.

Category: Opinion

What ciphers does WPA2 use?

WPA2 mandates AES‑CCMP for confidentiality and integrity; TKIP is deprecated and should be disabled.

Category: Explanation

How should passwords be managed for WPA2‑PSK?

Use long, random passphrases, rotate periodically, and avoid sharing across SSIDs; consider moving to 802.1X.

Category: Requirements