WPA3 vs WPA2: What Changed and Why It Matters

WPA2-Personal authenticates clients using a Pre-Shared Key run through a 4-way handshake (defined in IEEE 802.11i) to derive the Pairwise Transient Key. The handshake itself is visible to anyone within radio range — an attacker only needs to capture the four EAPOL frames (or force one with a deauthentication attack) and then run an offline dictionary or brute-force attack against the PSK with tools like hashcat or aircrack-ng. Because the cracking happens offline, the attacker is not rate-limited by the access point at all; success depends purely on password strength and attacker compute.

KRACK (Key Reinstallation Attack, disclosed in 2017) demonstrated a second class of problem: implementation-level nonce and key reinstallation flaws in the 4-way handshake state machine that allowed traffic decryption and, in some configurations, packet forgery or injection — without ever needing the PSK itself. KRACK was patched via vendor updates to the WPA2 handshake logic, but it underlined that the protocol's state machine was fragile and gave the Wi-Fi Alliance strong motivation to replace the exchange outright rather than keep patching it.

WPA3-Personal replaces the PSK 4-way handshake with SAE (Simultaneous Authentication of Equals), a password-authenticated key exchange based on the Dragonfly handshake (RFC 7664). SAE is a zero-knowledge proof protocol: both parties prove they know the shared password without ever transmitting anything derived from it in a form that can be attacked offline. Critically, SAE provides resistance to offline dictionary attacks — an attacker who captures the full exchange still cannot brute-force the password offline. Each guess requires an active, real-time exchange with the AP, so attacks are throttled to one guess per live interaction, and repeated failures are rate-limited by the SAE anti-clogging mechanism.

SAE also provides forward secrecy, which WPA2-PSK does not. In WPA2, if the PSK is ever recovered, every session ever captured for that network (past or future, as long as the PSK is unchanged) can be decrypted. Under SAE, each session derives fresh, ephemeral keying material, so recovering the password does not let an attacker retroactively decrypt previously captured traffic.

It's worth being precise about what SAE does not fix: it doesn't make weak passwords strong. A trivially guessable password is still guessable via active online attempts, and captive-portal style social engineering, evil-twin APs and client misconfiguration remain fully viable attack paths regardless of SAE.

802.11w defines Protected Management Frames (PMF), which cryptographically protect management frames — deauthentication and disassociation frames in particular — from forgery. Under WPA2, PMF was optional and rarely enabled by default, which is why deauth-based attacks (forcing a client to re-associate so you can capture a fresh handshake, or simply as a denial-of-service) have been a staple of Wi-Fi pentesting for years.

WPA3 makes PMF mandatory for both Personal and Enterprise modes. This closes off the trivial deauth-flood DoS and the handshake-capture-via-forced-reassociation technique as a practical attack against WPA3-only networks. It does not eliminate RF-layer jamming or all denial-of-service classes — an attacker can still saturate the spectrum — but it removes the cheap, targeted, frame-spoofing version of the attack.

WPA3-Enterprise continues to use 802.1X/EAP for authentication against a RADIUS server, same as WPA2-Enterprise — this layer did not fundamentally change. What WPA3-Enterprise adds is an optional 192-bit security mode, aligned with CNSA (Commercial National Security Algorithm) suite requirements, intended for government, defense and high-assurance environments. This mode mandates specific cryptographic primitives across the whole stack: 256-bit GCMP for data confidentiality, 384-bit HMAC-SHA384 for key derivation, and elliptic-curve key establishment using a 384-bit curve, rather than allowing the mix of weaker options WPA2-Enterprise implementations were permitted to negotiate.

The 192-bit mode is optional and mainly relevant to environments with a specific compliance mandate; most enterprise deployments run standard WPA3-Enterprise, which is functionally an incremental hardening of WPA2-Enterprise (mandatory PMF, no downgrade to weaker ciphers) rather than a different authentication model.

Because client hardware and driver support for WPA3 rolled out gradually, most access points support a WPA2/WPA3 transition (mixed) mode, broadcasting a single SSID that accepts both WPA2-PSK and WPA3-SAE clients. This is necessary for compatibility but reintroduces risk: the AP must still support the legacy WPA2 4-way handshake for older clients, so an attacker can often force a downgrade by spoofing the AP's support for WPA2-only in specific frames, or simply by targeting whichever clients are still connecting via WPA2 on that same SSID. Security engineers should treat transition-mode SSIDs as WPA2-equivalent in threat modelling until legacy client support can be fully retired onto a separate, WPA3-only SSID.

The table below summarizes the security-relevant differences between WPA2 and WPA3 in their Personal and Enterprise modes.

• •Run WPA3-only SSIDs wherever client support allows it; treat mixed transition-mode SSIDs as WPA2-equivalent risk until legacy clients are retired.
• •For enterprise networks, WPA3-Enterprise with EAP-TLS and PMF enforced is the strongest widely-deployable configuration; reserve 192-bit mode for environments with an explicit CNSA/compliance requirement.
• •SAE does not replace password hygiene on Personal networks — enforce a strong, unique passphrase; SAE only removes the offline-cracking shortcut, not weak-password risk from targeted online guessing.
• •Audit AP firmware for PMF support and confirm it is actually enforced (not just advertised) — some early WPA3 firmware implementations shipped with PMF negotiable rather than strictly required.