The question of which IEEE standard governs the WPA2 protocol is fundamental for information security specialists and network administrators. Many users mistakenly believe that WPA2 is simply another software version, without considering the underlying engineering standards. In fact, this acronym stands for a rigorous specification developed by the Institute of Electrical and Electronics Engineers.
Understanding the relationship between marketing name Wi-Fi Protected Access 2 and technical standards allow for a more thorough assessment of the level of protection of transmitted data. This knowledge is critical when selecting equipment for corporate networks or building a secure home network. It is the specification IEEE 802.11i became the foundation that corrected the critical vulnerabilities of previous generations of wireless networks.
In this article, we'll examine the architectural features of this standard in detail, examine its encryption mechanisms, and explore why its adoption has become a necessary step in the evolution of wireless communications. You'll learn how Wi-Fi Alliance certification differs from official IEEE documents and how these standards interact in real-world equipment.
Definition of the IEEE 802.11i base standard
The direct answer to the question of which IEEE standard refers to the WPA2 protocol is the specification IEEE 802.11iThis document was ratified in 2004 and was intended to replace the outdated and insecure Wired Equivalent Privacy (WEP) protocol. The developers' primary goal was to create a mechanism that would ensure confidentiality, data integrity, and user authentication at a level comparable to wired Ethernet networks.
It is important to distinguish between the terms WPA2 and 802.11i, although in the public consciousness they are often merged into one concept. IEEE 802.11i WPA2 is the official technical standard describing security mechanisms, while WPA2 is a trademark and certification program of the Wi-Fi Alliance. WPA2 certification ensures that a device fully complies with the 802.11i standard and has passed interoperability tests.
⚠️ Attention: Not all devices labeled "802.11n" or "802.11ac" automatically support full 802.11i security functionality unless the manufacturer has achieved WPA2 certification. When purchasing equipment for critical infrastructure, demand confirmation of compliance with the security standard, not just the data transfer rate.
Standard 802.11i introduces the concept of RSN (Robust Security Network). This isn't just an algorithm update, but a complete redesign of the security architecture. This specification defines new protocols for per-frame authentication and dynamic encryption key updates, making traffic interception extremely difficult even for advanced attackers.
RSN Security Architecture and Components
The architecture described in the standard IEEE 802.11i, is based on the concept of RSN, which requires the use of specific protocols for key management and data encryption. The key element here is the protocol 802.1X, which provides port-based access control. In the context of Wi-Fi, this means that a device will not be granted network access until it has passed the authentication process.
To implement these mechanisms, the standard defines two main operating modes: personal (PSK) and enterprise (Enterprise). Personal mode uses a pre-shared key entered by the user. Enterprise mode relies on a server. RADIUS, which allows you to issue unique keys for each user and centrally manage access rights.
The specification also introduces the concept of a 4-way handshake. This process is necessary to confirm that both parties (the client and the access point) have the correct password without transmitting the password over the air. During this exchange, temporary keys are generated, which are used to encrypt the session.
- 🔐 PMK (Pairwise Master Key) - a master key generated from a password or authentication server that is never transmitted over the network.
- 🔄 PTK (Pairwise Transient Key) is a temporary key created to encrypt traffic between a specific access point and a specific client.
- 📡 GTK (Group Temporal Key) is a key used to encrypt broadcast and multicast traffic on a network.
Why is a four-way handshake dangerous?
Although the process itself is secure, attackers can intercept handshake packets when connecting a new device. Using this data, they can attempt to brute-force the password offline, without being within network range. This is why it's critical to use complex passwords longer than 12 characters.
Encryption Protocols: AES vs. TKIP
One of the main achievements of the standard IEEE 802.11i The introduction of a new encryption protocol CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol), which is based on the algorithm AES (Advanced Encryption Standard). AES is considered the gold standard of cryptography and provides a high level of security that is difficult to break even with modern computing power.
To ensure backward compatibility with older equipment that did not support AES, the protocol was left in the specification. TKIP (Temporal Key Integrity Protocol). However, the use of TKIP within WPA2 is considered a temporary measure. This protocol was created as a "workaround" to patch holes in WEP without replacing hardware, but it is significantly slower and less secure than AES.
Modern security requirements dictate abandoning TKIP in favor of pure AES mode. Many new devices and operating systems may not even support connecting to networks that only allow TKIP. When configuring your router, always select this mode. WPA2-PSK (AES)to ensure maximum speed and protection.
| Characteristic | TKIP (Temporary) | AES-CCMP (Recommended) |
|---|---|---|
| Basis of the algorithm | RC4 (as in WEP) | Rijndael (AES) |
| Key length | 128 bits | 128, 192 or 256 bits |
| Data integrity | MIC (Michael) | CBC-MAC |
| Impact on speed | Reduces throughput | Hardware acceleration, high speed |
Authentication process and EAP
In the corporate segment the standard IEEE 802.11i relies on the Extensible Authentication Protocol EAP (Extensible Authentication Protocol). This isn't a single method, but one that allows for the use of various authentication mechanisms, such as certificates, smart cards, or logins and passwords. EAP's flexibility makes it possible to build complex multi-factor security systems.
The messaging process in Enterprise mode is more complex than in a home network. The access point here acts merely as an intermediary, forwarding credentials between the client and the RADIUS server. This eliminates the need to store user passwords on each router, and allows for centralized access management in a single database.
The most common EAP methods in conjunction with WPA2 are PEAP (Protected EAP) and EAP-TLS. The former is often used with Active Directory logins and passwords, as it creates a secure tunnel for transmitting credentials. The latter method, EAP-TLS, is considered the most secure, as it requires digital certificates on both the server and the client device.
⚠️ Attention: When setting up corporate Wi-Fi, ensure that the time on the RADIUS server and access points is synchronized via NTP. Even a few minutes' misalignment can result in authentication failure due to invalid timestamps in certificates.
Vulnerabilities and the evolution of standards
Despite the fact that IEEE 802.11i Although it was a huge step forward, it was not without its vulnerabilities. The most notorious issue was the KRACK (Key Reinstallation Attack), discovered in 2017. It exploited a flaw in the four-way handshake logic, allowing an attacker to forcibly reset the packet sequence number and reuse them.
It's important to understand that the KRACK vulnerability affected the protocol implementation, not the AES encryption algorithm itself. This means that the Wi-Fi password wasn't stolen, but the traffic could have been decrypted if the attack was successful. Equipment manufacturers quickly released patches to close this vulnerability, further emphasizing the importance of regular firmware updates.
With the emergence of new threats, the industry has moved to the next stage - the standard WPA3, which is based on the specification IEEE 802.11-2016 and newer versions. WPA3 implements brute-force attack protection (SAE) and mandatory encryption even on open networks. However, WPA2 remains the widely used standard due to its compatibility with billions of devices.
☑️ Check your network security
Practical recommendations for setting up
When configuring a wireless network according to the standard IEEE 802.11i It's important to select the correct protocol mixing mode. Router menus often feature "WPA/WPA2 Mixed" options. While this is convenient for compatibility, the presence of legacy WPA (TKIP) reduces the overall security of the entire network to the level of the weakest link.
For home networks, the optimal choice is the mode WPA2-PSK (AES)If you have very old devices (such as previous-generation gaming consoles) that cannot see the network in this mode, it's better to consider replacing them or using a guest network segment rather than downgrading the security of your primary infrastructure.
Remember that Wi-Fi security isn't just about protocol selection. The physical location of the access point, disabling unnecessary management services, and monitoring connected clients are equally important. The 802.11i standard provides tools, but proper configuration remains the responsibility of the administrator.
Frequently Asked Questions (FAQ)
What is the main difference between WPA2 and the 802.11i standard?
IEEE 802.11i — is a technical specification developed by the IEEE that describes security mechanisms. WPA2 — is a trademark and certification program of the Wi-Fi Alliance that guarantees that a device meets 802.11i requirements and has passed interoperability tests. Simply put, 802.11i is the law, and WPA2 is the stamp of compliance.
Is it possible to hack a network protected by the 802.11i (WPA2-AES) standard?
It's virtually impossible to crack the AES encryption algorithm itself using brute-force methods within a reasonable time. However, a network can be compromised through implementation vulnerabilities (such as KRACK), social engineering (stealing a user's password), or if a connected device is infected with viruses. A weak password also renders the protection useless.
Should I switch to WPA3 if my router supports both standards?
Yes, transition to WPA3 Recommended because it addresses known WPA2 vulnerabilities, such as offline password cracking. However, make sure all your devices support the new standard, otherwise they may stop connecting. Mixed mode (WPA2/WPA3) may downgrade security to WPA2 for older clients.
Why does Wi-Fi speed drop when I select Compatibility Mode?
Compatibility modes (e.g., WPA/TKIP + WPA2/AES) often force the network to operate at a slower speed so that older devices can "understand" packet headers. Furthermore, the TKIP protocol software-limits the maximum data transfer rate, often preventing it from exceeding 54 Mbps, even if the physical link allows for more.