Looking for more secure Wi-Fi? WPA2 (Wi-Fi Protected Access 2) gives wireless networks both confidentiality and data integrity, two terms not previously associated with Wi-Fi.

Security, of course, has long been the trade-off with Wi-Fi. Early wireless networks leaned heavily on VPNs to provide Layer 3 security, which--aside from the additional overhead of encapsulation and the challenges of roaming, quality of service, client support and scalability--left the IP network vulnerable to attacks. The Layer 2-based WPA2 better protects the network.

But WPA2 alone can't provide enterprise security: Combining WPA2 with the IEEE 802.1X port-based authentication protocol for access control should eliminate most security worries. This won't protect you from rogues, denial-of-service attacks or interference, but it will ensure secure wireless communication.

The Wi-Fi Alliance's WPA2 security spec is a major improvement over WEP (Wired Equivalent Privacy), the security standard in IEEE's original 802.11 (for more on WEP, see "WEP: Old-School Security for Wi-Fi" at ). WEP was susceptible to attacks and poorly implemented by vendors, and never took off in the enterprise. WEP's weaknesses and the ease with which they've been exploited led to the 802.11i standard, which was approved and published in 2004. The Wi-Fi Alliance created WPA, a subset of the draft version 802.11i, and later, WPA2, which provided stronger security than the first version of WPA.

Standards Click to enlarge in another window

WPA came with support for TKIP (Temporal Key Integrity Protocol), which uses the RC4 cipher, and it can be implemented in software with just a driver or firmware update. Keys are rotated frequently, and the packet counter prevents packet replay or packet re-injection attacks. WPA provides integrity checking using MIC (Message Integrity Code), sometimes nicknamed "Michael." Although this checksum method can be attacked with brute-force methods, network traffic is halted automatically for a minute and the session keys reset if a WPA-based access point detects more than one TKIP MIC failure within 60 seconds, so the risks are minimal.

WPA2, meanwhile, uses a new encryption method called CCMP (Counter-Mode with CBC-MAC Protocol), which is based on AES (Advanced Encryption Standard), a stronger encryption algorithm than RC4.

Both WPA and WPA2 include two authentication modes: personal and enterprise. WPA2-Personal generates a 256-bit key from a plain-text pass phrase, sometimes called a PSK, or preshared key. The PSK (as well as the Service Set Identifier and SSID length) form the mathematical basis for the PMK (pairwise master key) that's used to initiate a four-way handshake and generate the PTK (pairwise transient key)--or session key--between the wireless user device and access point. WPA2-Personal, like static WEP, poses challenges in key distribution and maintenance, making it a fit for small offices but not the enterprise.

WPA2-Enterprise, meanwhile, addresses concerns regarding distributing and managing static keys, and controls access on a per-account basis by tying in to most organizations' authentication services. This mode requires credentials, such as a user name and password, a certificate or a one-time password, and authentication occurs between the station and central authentication server. The access point or wireless controller monitors the connection and directs authentication packets to the appropriate authentication server, typically a RADIUS server. The framework for this is 802.1X, which supports user and machine authentication with port-based control that works for both wired switches and wireless access points.