When the KRACK vulnerability was exposed in 2017, many people knew that WPA2 is not safe.
Recently, the Wi-Fi Alliance (a maker of Wi-Fi standards) announced that the WPA3 Wifi authentication protocol standard will be released later this year, but the first details announced earlier include four key features, This allows users and hardware vendors are looking forward to the standard.
The birth of this new agreement is largely to fundamentally solve the high-risk vulnerabilities discovered a few months ago.
Last October, University of Leuven researcher Mathy Vanhoef found that there was a serious security hole in the WPA2 protocol that affected almost all Wi-Fi devices, including computers, smartphones, and routers. An attacker can exploit this vulnerability to launch a KRACK that reads all traffic destined to the Wi-Fi connection, such as credit card numbers, account passwords, chat history, photo video, etc. Although some of the traffic is itself Encryption, but there are still serious risks. In addition, an attacker does not need to know the user’s Wifi password when performing an attack, so changing the password can not defend against the attack.
Some people think that this attack has a limited impact and must be physically close to the target being attacked. We can envision a scenario where a hacker successfully monitors your payment behavior by attacking the mall’s Wi-Fi. The implementation of the scene is very difficult, but the consequences are terrible.
This attack can cause great harm because the WPA2 protocol itself has loopholes, WPA2 is been for more than 10 years, there should be a new updated version to replace it, WPA3 protocol came into light.
4 new features in WPA3
- prevent violent attacks by blocking the WiFi authentication process after several unsuccessful login attempts. This is an essential feature of many web or software authentication systems and is well suited for deployment on Wi-Fi networks, which are often subject to dictionary violent attacks.
- users can use nearby devices that support Wi-Fi as a configuration panel for other devices. For example, a user can use his phone or tablet to set WPA3 options for small screenless IoT devices such as smart locks, smart bulbs, and the like.
- “Personalized Data Encryption,” a feature that encrypts the connection between each device and a router or access point.
- improved encryption standard that the Wi-Fi Alliance describes as “a suite of 192-bit security suites that is compatible with the National Security Council CNSA suite to further protect even more Security requirements for wireless networks, such as for government, defense and industrial networks. “
The third and fourth functions are related to the encryption features included in WPA3
WPA3 is expected to launch in few months
While the Wi-Fi Alliance is fast moving and is coming up with a new version of the WPA Wi-Fi certification standard, it will take some time for users to buy devices that include WPA3 support.
Mathy Vanhoef, author of “The KRACK attack on WPA2,” told the media that “the standard behind WPA3 has existed for a while, but now the devices are all” required “to support the standard or they will not be able to get the” WPA3 Certified “label. ”
He also said: “The open-source Wi-Fi clients and wireless access nodes of Linux will support this improved technology but have not yet been put into use. This phenomenon is expected to change now.”