KRACK
Vanhoef & Piessens (2017). The WPA2 4-way handshake installs a fresh transient key (PTK) after message 3. Vanhoef showed that replaying message 3 forces the supplicant to reinstall the same key, which resets the nonce/replay counter on the supplicant side. With a reused nonce under WPA2's default AES-CCMP (CTR mode + CBC-MAC), the keystream repeats and plaintext leaks. GCMP, used in WPA3 and some 802.11ad/ax modes, is even more brittle under nonce reuse because authentication keys are also recoverable.
Variant attacks: against the group key handshake (GTK reinstallation), against fast transition (FT, 802.11r) which is even worse because the key is held without re-derivation. Patched in client drivers and AP firmware in 2017-2018; the protocol-level fix is in 802.11-2020.
Dragonblood
Vanhoef & Ronen (2019) against WPA3-SAE. Multiple flaws:
- Side-channel on the hash-to-curve operation: timing and cache leaks in the password-to-element conversion let attackers learn information about the password.
- Downgrade attacks: WPA3-transition mode (offers both WPA2 and WPA3 to support old clients) allowed an attacker to force WPA2.
- Denial of service: SAE is computationally expensive on the AP; flooding handshake initiations exhausts CPU.
The WPA3 spec was updated and major vendors patched. The pattern: even cryptographically sound protocols leak through implementation side channels.
Wi-Fi 6/7 security additions
- WPA3 mandatory for Wi-Fi Alliance "Wi-Fi CERTIFIED 6" devices since the program launch in 2019 (the 802.11ax PHY itself does not require it; the certification does). Wi-Fi 7 (802.11be) extends this.
- Protected Management Frames (PMF, 802.11w) mandatory: signs management frames (deauth, disassoc, association) to prevent the trivial deauth-injection attack that has plagued Wi-Fi since the start.
- Beacon protection (802.11-2020) extends MIC to beacon frames, preventing rogue beacon injection.
- Operating Channel Validation: clients can verify they are on the expected channel, mitigating channel-switch attacks.
Opportunistic Wireless Encryption (OWE)
RFC 8110. Open Wi-Fi (coffee shop, hotel) replaced by OWE: a Diffie-Hellman exchange happens during association, producing a per-association session key. The user sees an open network; the wire is encrypted.
OWE does not authenticate the AP, so an evil twin can still capture traffic for a session it owns. But it eliminates passive eavesdropping on legitimate APs, which is a meaningful improvement over plain open Wi-Fi.
Adoption is uneven. Many APs support it; many clients ignore it. Look for "Enhanced Open" in client settings.
Fast Transition trade-offs
802.11r lets clients roam between APs in the same network without re-authenticating. Uses a Pairwise Master Key cached at all APs in the mobility domain. Trade-offs:
- Faster roam (50ms instead of 500ms).
- If the cached key leaks (rogue AP joins the mobility domain), wider blast radius.
- KRACK variant was particularly effective against FT because of how the key was reused.
Enterprise deployments typically enable FT for voice and video; high-security deployments disable it.
Where Wi-Fi security goes wrong now
- Mixed-mode networks (WPA2+WPA3) for legacy support; downgrade attacks persist.
- Default credentials on consumer APs (router admin passwords).
- WPS still enabled by default on many APs; the 7-digit PIN brute-forces in hours.
- Captive portals that ask users to install certificates (the eternal phishing vector).
- Pre-shared keys posted on every cafe wall.
The protocol layer has caught up. The deployment layer has not.