WPA3

WPA3, short for Wi-Fi Protected Access 3, is the security system that protects a Wi-Fi network. It checks that a device knows the network password or holds valid credentials, then encrypts the traffic between the device and the router. The Wi-Fi Alliance, the industry group that certifies Wi-Fi products, introduced WPA3 on 25 June 2018 as the successor to WPA2, and it now states that WPA3 is mandatory for Wi-Fi CERTIFIED devices. Routers certified today must therefore offer it, but many smart home devices still support only WPA2, which is why WPA3 often comes up when a smart plug or a robot vacuum refuses to connect.

What is the difference between WPA3 and WPA2?

The main difference is how a device proves that it knows the password. In WPA2-Personal, often labeled WPA2-PSK (pre-shared key), the router and the device exchange a few messages at connection time that are derived from the password. Someone within range can record those messages and then try candidate passwords on their own computer, as fast as it can run, without touching the network again. This is called an offline dictionary attack, and it works well against short or common passwords.

WPA3-Personal replaces that exchange with SAE (Simultaneous Authentication of Equals), which the Wi-Fi Alliance describes as “a secure key establishment protocol between devices” that protects against password guessing. SAE is a version of a method called Dragonfly. The Dragonfly specification, RFC 7664, says it is “resistant to active attack, passive attack, and offline dictionary attack”. In practice an attacker has to talk to the network for every single guess, which is slow and can be noticed. A good password still matters: SAE does not help if someone already knows it or guesses it in a few tries.

WPA3 networks must also use Protected Management Frames, which protect some of the network’s control messages, such as the ones that tell a device to disconnect, from being forged, and must refuse outdated legacy protocols, according to the Wi-Fi Alliance.

What is WPA3 transition mode?

Transition mode is a router setting that lets WPA2 and WPA3 devices join the same network, with the same name and password. The Wi-Fi Alliance planned it from the start so that homes could adopt WPA3 without replacing older devices: a new phone uses WPA3, an old smart plug keeps using WPA2.

The cost is that the network is only as strong as its WPA2 side. In 2019 researchers Mathy Vanhoef and Eyal Ronen showed, in work they called Dragonblood, that an attacker can set up a fake WPA2-only copy of a transition-mode network, lure WPA3-capable devices onto it, and then guess the password offline from what they capture. They also found weaknesses in the SAE handshake itself and in some early products that implemented it, and the Wi-Fi Alliance responded with security recommendations to makers. Transition mode is a sensible bridge, but while WPA2 devices remain on the network, a long and unique password is still the main defense.

What is WPA3-Enterprise?

WPA3-Enterprise is the version for companies, schools and other organizations, where each person or device signs in with its own credentials, such as a username and password or a digital certificate, checked by a central server. Nobody shares one password, so a person who leaves can be removed without changing the password for everyone else; this is authentication per user rather than per network. WPA3-Enterprise also includes a 192-bit security suite that offers “the equivalent of 192-bit cryptographic strength”, which the Wi-Fi Alliance aims at networks carrying sensitive data, such as government or finance. Home routers rarely use it.

Why don’t many smart home devices support WPA3?

Many smart devices run on small, low-cost Wi-Fi chips with firmware written before WPA3 was common, and makers do not always update older products to add it. Support depends on the chip, the firmware and the maker’s choices, and the box often does not say. iRobot, for example, writes in its setup instructions for Wi-Fi connected robots: “We do not support WPA3 security.” A device without WPA3 cannot join a network that accepts WPA3 only, and it often shows a vague “cannot connect” error rather than naming the cause.

This often appears after a router upgrade. Wi-Fi 7 routers can run a 6 GHz network, and the Wi-Fi Alliance’s Wi-Fi 6E certification, the one for devices that use the 6 GHz band, uses WPA3.

What can you do if a smart device cannot connect to a WPA3 network?

First check whether the device or its app has a firmware update. If none adds WPA3, these are the options, from the most to the least protective:

• A separate network for smart devices. Many routers can create a second network, often called a guest or IoT network, with its own name and password. Set that one to WPA2 or transition mode and keep phones and laptops on the main WPA3 network. This also keeps smart devices apart from your computers, a simple form of network segmentation.
• Transition mode on the main network. Everything connects, but any device that uses WPA2 gets WPA2-level protection, with the downgrade risk described above.
• WPA2 only. Workable with a long, random password, but every device gives up what WPA3 adds.

Do not fall back to older options such as WEP or an open network with no password: they offer little or no protection. The IoT security fundamentals guide explains how attacks on connected devices usually start.

What are Wi-Fi Enhanced Open and Wi-Fi Easy Connect?

They are two companion programs of the Wi-Fi Alliance: its WPA3 announcement introduced Easy Connect and noted that Enhanced Open had been introduced shortly before. Enhanced Open encrypts traffic on open networks that have no password, such as those in cafés or airports, so people nearby cannot simply read it. It is based on Opportunistic Wireless Encryption, described in RFC 8110. It does not check who is connecting, so it is no substitute for a password at home.

Easy Connect is meant for devices with “limited or no display interface”, which describes most smart home gadgets. Instead of typing the Wi-Fi password into an app, you add the device by scanning a QR code with a phone. Whether you can use it depends on the router, the phone and the device all supporting it.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.