Hi WDNJSQ,
WPA3 introduces Simultaneous Authentication of Equals (SAE), which is a more secure handshake protocol, a WPA2 network, however, is vulnerable to PASSWORD cracking attacks.
WPA3-Personal introduces the SAE handshake protocol. Compared with WPA/WPA2-PSK authentication, WPA3-SAE can effectively defend against offline dictionary attacks and mitigate brute force cracking posed by weak PASSWORDs. In addition, the SAE handshake protocol provides forward secrecy. Even if an attacker knows the PASSWORD on the network, the attacker cannot decrypt the obtained traffic, greatly improving the security of a WPA3-Personal network.
WPA3-Enterprise still uses the authentication system of WPA2-Enterprise and uses the Extensible Authentication Protocol (EAP) for identity authentication. However, WPA3 enhances the algorithm strength by replacing the original cryptography suite with the Commercial National Security Algorithm (CNSA) Suite defined by the Federal Security Service (FSS). The CNSA Suite has a powerful encryption algorithm and applies to scenarios with extremely high-security requirements.
WPA2 is still widely used. To enable WPA3-incapable STAs to access a WPA3-configured network, the Wi-Fi Alliance defines the WPA3 transition mode. That is, WPA3 and WPA2 can coexist for a period of time in the future. This mode applies only to WPA3-Personal.
For open Wi-Fi networks, the Wi-Fi Alliance proposes Opportunistic Wireless Encryption (OWE) authentication based on open-system authentication of WPA3. OWE authentication is a Wi-Fi Enhanced Open authentication mode that allows for network access without the need to enter the PASSWORD. In OWE authentication mode, a device uses the AES encryption algorithm to encrypt data on the network, thereby protecting data exchange between STAs and the Wi-Fi network.
The process of OWE authentication is similar to that of SAE. The difference is that OWE authentication eliminates the need for PASSWORD maintenance. This authentication mode uses the Diffie-Hellman protocol to exchange keys to generate a PMK used for the subsequent four-way handshake. In addition to retaining the convenience of open networks, OWE authentication ensures data security for these networks.
The OWE transition mode provides backward compatibility with STAs that do not support OWE authentication. That is, non-OWE STAs access the network in open-system authentication mode, while OWE STAs access the network in OWE authentication mode. The OWE transition mode supports only the AES encryption mode.
In V200R019C00, ACs and APs support WPA3 authentication. In V200R019C10, only ACs support WPA3 authentication. OWE authentication is available since V200R020C10.
