When it comes to wireless security, the term WPA2 (Wi-Fi Protected Access 2) is heard almost more often than others. This protocol has remained the basis for protecting home and corporate Wi-Fi networks for over 15 years, but not all users know that its operation is regulated by a specific standard. IEEESo what document is the basis of WPA2, and why is it still relevant despite the advent WPA3?
The answer is simple: for the architecture and mechanisms WPA2 meets the standard IEEE 802.11i-2004 - it is he who determines the protocol Robust Security Network (RSN), which is implemented in WPA2. However, the relationship between these concepts often causes confusion: some sources talk about IEEE 802.11i Some consider it a synonym for WPA2, while others consider it its technical basis. In this article, we'll explore how the standard relates to the protocol, what security mechanisms it describes, and why, even in 2026, 802.11i remains critically important for Wi-Fi networks.
You will learn not only about the formal aspects of the standard, but also how its provisions affect the daily operation of routers, why some devices still do not support it. WPA3, and what vulnerabilities IEEE 802.11i were discovered over the years of operation. And for those setting up a network themselves, we've prepared practical recommendations for choosing a security mode depending on the equipment.
What is IEEE 802.11i and how does it relate to WPA2?
Standard IEEE 802.11i was ratified in In 2004 as a response to the critical vulnerabilities of the previous security protocol - WEP (Wired Equivalent Privacy)Its main purpose is to provide secure authentication and encryption of data in wireless networks. It is important to understand that 802.11i - This data sheet, A WPA2 - its practical implementation, certified by the alliance Wi-Fi Alliance.
Key components of the standard:
- 🔐 CCMP (Counter Cipher Mode with Block Chaining Message Authentication Code Protocol) — the main encryption mode based on the algorithm AES.
- 🤝 4-Way Handshake — authentication mechanism between the client and the access point.
- 🔄 RSN (Robust Security Network) - architecture replacing the outdated WPA (which was a temporary solution based on TKIP).
- 🛡️ PMK (Pairwise Master Key) — hierarchical key generation system.
In fact, when you choose WPA2-PSK or WPA2-Enterprise In the router settings, you activate the mechanisms described in IEEE 802.11i. It is interesting that the standard itself does not contain the term "WPA2" - this is a marketing name invented Wi-Fi Alliance to simplify user perception.
Differences between IEEE 802.11i and WPA and WPA3
To understand the uniqueness 802.11i, it is worth comparing it with its predecessors and successors. Unlike WPA (802.11i Draft), which was an intermediate solution with a vulnerable TKIP, a full-fledged standard IEEE 802.11i-2004 introduced mandatory use AES-CCMP - incompatible with legacy equipment, but much more secure.
Comparison of key protocols:
| Characteristic | WEP | WPA (802.11i Draft) | WPA2 (802.11i) | WPA3 |
|---|---|---|---|---|
| Year of implementation | 1999 | 2003 | 2004 | 2018 |
| Basic encryption algorithm | RC4 | TKIP (backward compatibility) | AES-CCMP | AES-GCMP (128/192-bit) |
| Vulnerability to attacks | Extremely high | Average (PSK) | Low (when set up correctly) | Very low |
| Support for legacy devices | Yes | Yes | Partial (AES only) | No |
The main difference WPA3 (based on IEEE 802.11-2020) from 802.11i - introduction SAE (Simultaneous Authentication of Equals) instead of vulnerable Pre-Shared Key (PSK), as well as improved protection against brute-force attacks. However, WPA2 remains mandatory for certification all Wi-Fi devices, whereas WPA3 - optional.
⚠️ Attention: Some budget routers and IoT devices (such as smart light bulbs or cameras) still only supportWPA2-PSKWith TKIP - this mode is inherited from WPA and is considered unsafe. Always chooseAES-CCMPin security settings.
How does encryption work in the 802.11i standard?
Security core IEEE 802.11i - This 4-Way Handshake, which occurs when a device is connected to the network. The process looks like this:
- Access point (AP) sends a random number to the client (ANonce).
- The client generates its own random number (SNonce) and sends it back along with a hash confirming knowledge PMK (network password).
- AP checks the hash, generates PTK (Pairwise Transient Key) and sends it to the client along with confirmation.
- The client establishes a connection using GTK (Group Temporal Key) for multicast traffic.
Key point: PMK is never transmitted over the air—its hash is used instead. However, this mechanism is vulnerable to attacks. offline brute-force, if the password is weak. That's why in WPA3 protocol implemented SAE, protecting against brute force.
Details on 802.11i key generation
PTK (Pairwise Transient Key) is formed from PMK, ANonce, SNonce and MAC addresses of devices according to the formula:
PTK = KDF(PMK, ANonce, SNonce, MAC_AP, MAC_Client), where KDF is the key derivative function.
GTK is updated periodically (by default every 3600 seconds) to protect against multicast traffic eavesdropping.
Traffic encryption is performed using AES-CCMP, which provides:
- 🔒 Data privacy (block encryption) AES in mode
CCM). - 🛡️ Packet integrity (authentication code) MIC).
- 🔄 Protection against packet replay (use of counters).
⚠️ Attention: If the mode is available in the router settingsWPA2-PSK (TKIP), it should be disabled. TKIP was a temporary solution for compatibility with older hardware and contains vulnerabilities (eg Chopchop attack). Use onlyAES.
802.11i vulnerabilities and protection methods
Despite the high reliability, IEEE 802.11i is not without vulnerabilities. The most well-known attacks:
- 💥 KRACK (Key Reinstallation Attack, 2017) - exploits reuse nonce in 4-Way Handshake. All devices with support are vulnerable 802.11i, but fixes have been released for most OS.
- 🔑 Dragonblood (2019) - attacks on WPA3, but some vectors also affect WPA2 (for example, weak Diffie-Hellman groups).
- 📡 Evil Twin - creating a fake access point with the same SSID, deception of clients for interception 4-Way Handshake.
How to minimize risks?
Update your router firmware to the latest version
Disable WPS (Wi-Fi Protected Setup)
Use a complex password (12+ characters, with numbers and special characters)
Enable MAC address filtering (not a panacea, but will make it more difficult to attack)
Disable remote router administration (port 80/443)
-->
For corporate networks it is recommended to use WPA2-Enterprise with the server RADIUS (For example, FreeRADIUS), which supports:
- 🆔 Certificate authentication (EAP-TLS).
- 🔐 Dynamic key generation for each session.
- 📊 Centralized management of security policies.
sudo apt install wpa-supplicant && wpa_supplicant -vThe output should contain the version 2.7 or later (released after October 2017).-->
Why is WPA2 (802.11i) still relevant in 2026?
Despite the exit WPA3 in 2018, WPA2 remains the most widely used security protocol. for several reasons:
- Backward compatibility: Billions of devices (from smartphones to printers) support only 802.11i.
- Wi-Fi Alliance Certification: WPA2 is mandatory for all new devices, while WPA3 — optional.
- Performance: AES-CCMP Optimized for hardware acceleration on most chipsets.
- The complexity of migration: transition to WPA3 requires a firmware update on all client devices.
According to data Wi-Fi Alliance, at the beginning of 2026 more than 70% of active Wi-Fi networks still in use WPA2 as a primary or backup protocol. WPA3 more common in the corporate segment, where protection from dictionary attacks (for example, in hotels or airports).
Hybrid mode WPA2/WPA3 Transition Mode Allows devices to connect using any protocol, but this reduces the overall network security level. The optimal option for home networks in 2026:
- 🏠 WPA2-AES only - if there are outdated devices on the network.
- 🔒 WPA3-SAE only - if all devices support the new standard.
How to configure a router for maximum security using the 802.11i standard?
Practical steps to optimize security:
- Selecting a security mode:
Go to
Wi-Fi Settings → Securityand selectWPA2-PSK(orWPA2/WPA3, if supported). Make sure that only the encryption is listed AES (without TKIP). - Setting up a password:
Use a password that is long 12+ characters with a mixture of registers, numbers, and special characters. Example:
k7#pL9!mQ2$vR5Avoid dictionary words and personal information. - Disabling legacy protocols:
In the section
Additional settingsturn it offWPS,WEPAnd802.11b(unless compatibility with very old devices is required). - Firmware update:
Check the firmware version in
System → UpdateFor routers ASUS, TP-Link or MikroTik Current versions patch vulnerabilities KRACK And Dragonblood.
For advanced users:
- 🔧 Set up VLAN for the guest network to isolate it from the main one.
- 📡 Reduce the transmit power (
Tx Power) to 50-70% to reduce the network range outside the home. - 🕒 Turn on Wi-Fi operating schedule (for example, switching off at night).
⚠️ Attention: Some providers (eg Rostelecom or Beeline) block access to advanced settings of the rented router. In this case, ask support to switch to the mode Bridge or use your own router.
The Future of the Standard: Will 802.11i Be Replaced?
Standard IEEE 802.11i has not been developed since 2004, but its mechanisms remain relevant thanks to updates (for example, patches for KRACK). At the same time Wi-Fi Alliance actively promotes WPA3, which includes:
- 🔐 SAE instead of PSK (brute force protection).
- 🛡️ Forward Secrecy (even if the key is compromised, past sessions remain protected).
- 📱 Simplified authentication for devices without a display (Wi-Fi Easy Connect).
However, the complete transition to WPA3 will take years due to:
- 💰 High cost of infrastructure upgrades (especially in the corporate segment).
- 📱 Lack of support on devices older than 2018 (eg. iPhone 6 or Samsung Galaxy S7).
- 🌍 Regional peculiarities: in some countries (for example, in China) WPA3 is being implemented more slowly due to local standards.
Experts predict that WPA2 (802.11i) will dominate until 2027–2030, especially in the segment IoT and budget devices. At the same time, hybrid networks (WPA2/WPA3) will become a transitional solution.
FAQ: Frequently Asked Questions about IEEE 802.11i and WPA2
❓ Is it possible to use WPA2 and WPA3 at the same time?
Yes, many modern routers support the mode WPA2/WPA3 Transition ModeHowever, this reduces the overall security level, as devices will connect using a less secure protocol (WPA2). It is optimal to choose one standard for the entire network.
❓ Why doesn't my router support WPA3?
Possible reasons:
- Outdated model (produced before 2018).
- Lack of hardware support SAE (requires chipset with acceleration AES-GCMP).
- The provider blocked the function in the firmware.
Solution: Check for alternative firmware (eg. OpenWRT) or upgrade your equipment.
❓ What password is considered secure for WPA2?
Minimum requirements:
- Length: 12+ characters.
- Composition: letters of both registers, numbers, special characters (
!@#$%). - Absence of: vocabulary words, names, dates of birth.
Example of a strong password: T8$kLp!2mQ9#vN.
❓ What is the difference between WPA2-Personal and WPA2-Enterprise?
WPA2-Personal (PSK) uses a common password for all devices, whereas WPA2-Enterprise requires a server RADIUS for individual authentication of each user (for example, by login/password or certificate). Enterprise- the mode is more difficult to set up, but much more secure for organizations.
❓ Is it possible to hack a WPA2 network?
Theoretically yes, but in practice this requires:
- Interception 4-Way Handshake (physical access to the network is required).
- Weak password (for brute force).
- Vulnerabilities in the implementation (e.g. unpatched KRACK).
When configured correctly (AES-CCMP + complex password) the risk of hacking is minimal.