7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation

Secure Wireless Access: WPA3, SAE, and MPSK Implementation

Quick Summary: Securing enterprise wireless networks requires cryptographic mechanisms that defend against eavesdropping, credential theft, and unauthorized network intrusion. While legacy WPA2-Personal relies on a static pre-shared key vulnerable to offline dictionary attacks, WPA3-Personal introduces Simultaneous Authentication of Equals (SAE) to deliver forward secrecy and zero-knowledge password protection. For enterprise networks, WPA3-Enterprise mandates Protected Management Frames (PMF) and offers 192-bit CNSA encryption. In the 6 GHz spectrum, legacy open and WPA2 security are strictly prohibited. To secure headless IoT devices lacking 802.1X support, Aruba's Multi-Pre-Shared Key (MPSK) architecture combines unique per-device passphrases with Aruba ClearPass role-based policy enforcement.

---

Cryptographic Flaws of Legacy WPA2-Personal (PSK)

For over fifteen years, WPA2-Personal (Wi-Fi Protected Access 2) served as the standard security method for non-enterprise wireless networks. WPA2-Personal utilizes a single Pre-Shared Key (PSK) configured across all client devices and access points.

The 4-Way Handshake Vulnerability

During client association in WPA2-Personal, the client and AP authenticate each other and derive encryption keys via the IEEE 802.11i 4-Way Handshake:

1. The client and AP independently calculate a 256-bit Pairwise Master Key (PMK) by hashing the network passphrase along with the SSID string using PBKDF2 (Password-Based Key Derivation Function 2) with 4,096 iterations.
2. Over four EAPOL (Extensible Authentication Protocol over LAN) frames, the AP and client exchange random nonces (ANonce and SNonce) to derive the Pairwise Transient Key (PTK) used to encrypt unicast data frames.

The Offline Dictionary Attack

Because the PMK derivation is deterministic and relies on the static passphrase, WPA2-Personal is acutely vulnerable to offline dictionary attacks:

• An attacker in physical proximity does not need to interact with the AP or trigger failed login alerts. The attacker passively sniffs the airwaves and captures the four EAPOL handshake frames transmitted when a legitimate user connects.
• Once captured, the attacker takes the handshake file offline and executes brute-force or dictionary cracking software (e.g., hashcat) using high-performance GPU clusters.
• The attacker tests millions of password guesses per second against the captured nonces without generating any network traffic or triggering intrusion detection alarms.

Lack of Forward Secrecy

In WPA2-Personal, all session keys (PTKs) are derived from the same master key (PMK). If an attacker captures encrypted wireless traffic today and compromises the network passphrase six months later (e.g., through social engineering or an employee departure), the attacker can retroactively decrypt all historically captured client communications. Furthermore, because every user shares the identical passphrase, any user on the network can decrypt the unicast traffic of every other user on the same SSID.

---

WPA3-Personal and Simultaneous Authentication of Equals (SAE)

Ratified by the Wi-Fi Alliance to replace WPA2, WPA3-Personal addresses these vulnerabilities by replacing the static PSK exchange with Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake (standardized in RFC 7664).

+-------------------------------------------------------------------------+
|          WPA3-Personal: Simultaneous Authentication of Equals (SAE)     |
+-------------------------------------------------------------------------+
      [Client Station]                                     [Aruba AP]
             |                                                 |
             | 1. SAE Commit Frame (Scalar + Element)          |
             |------------------------------------------------>|
             |                                                 |
             | 2. SAE Commit Frame (Scalar + Element)          |
             |<------------------------------------------------|
             |                                                 |
             | === Independent Calculation of Shared Key PMK ===|
             |                                                 |
             | 3. SAE Confirm Frame (Verification Hash)        |
             |------------------------------------------------>|
             |                                                 |
             | 4. SAE Confirm Frame (Verification Hash)        |
             |<------------------------------------------------|
             |                                                 |
             | 5. Standard 4-Way Handshake (Derives PTK)       |
             |<===============================================>|

How SAE and the Dragonfly Handshake Operate

SAE is a zero-knowledge proof protocol based on Diffie-Hellman discrete logarithm mathematics using elliptic curve cryptography (ECC):

1. Password Element (PWE) Derivation: Both the client and AP use the pre-shared passphrase and their respective MAC addresses to independently derive an elliptic curve point called the Password Element.
2. SAE Commit Phase: Both parties generate a private random number (scalar) and a private random mask. They exchange Commit frames containing the public scalar and an elliptic curve element. Crucially, the mathematical construction prevents an eavesdropper from reversing these values to determine the underlying password.
3. Independent Key Computation: Each side combines its private values with the peer's public commit data to independently compute the identical shared master key (PMK).
4. SAE Confirm Phase: Both devices exchange Confirm frames containing a cryptographic verification hash to prove that both parties derived the exact same PMK without ever disclosing the key or password.
5. PTK Derivation: With mutual authentication confirmed, the devices complete a standard 4-way handshake to generate the session-specific PTK.

Key Security Advantages of WPA3-Personal (SAE)

• Complete Immunity to Offline Dictionary Attacks: Even if an attacker captures the entire SAE exchange, the exchanged values contain zero password hashes that can be tested offline. The only way an attacker can test a password guess is by initiating an active, live handshake with the AP. This allows the network infrastructure to detect, rate-limit, and block brute-force attempts.
• Forward Secrecy: Each SAE association generates unique, ephemeral cryptographic keys that are completely independent of the passphrase and past sessions. If an unauthorized party discovers the network passphrase in the future, they cannot decrypt previously recorded traffic.
• Resilience for Natural Passwords: Users frequently choose simple or memorable passphrases. SAE protects passwords that fall short of rigorous cryptographic randomness from brute-force dictionary compromise.

---

Protected Management Frames (PMF / IEEE 802.11w)

In legacy 802.11 networks, while data frames were encrypted, management frames (such as Beacon, Probe, Association, Disassociation, and Deauthentication frames) were transmitted in completely unencrypted, unauthenticated cleartext.

The Denial-of-Service Vulnerability

Attackers exploited this architectural flaw by spoofing the MAC address of an access point and broadcasting forged Deauthentication frames to all associated clients. Because clients could not verify the authenticity of management frames, they immediately disconnected from the network. Attackers used this technique to knock users offline or force reconnections to capture WPA2 handshakes.

PMF Enforcement

IEEE 802.11w (Protected Management Frames - PMF) cryptographically authenticates unicast and broadcast management frames using a Broadcast Integrity Protocol (BIP):

• Any spoofed deauthentication or disassociation frame transmitted by an attacker lacking valid cryptographic keys is immediately discarded by the receiver.
• In WPA2, PMF was optional, and widespread lack of client support led most network administrators to disable it.
• In WPA3 (both Personal and Enterprise), PMF is strictly mandatory. An access point will reject any association request from a client that does not negotiate PMF capabilities.

---

WPA3-Enterprise and 192-bit CNSA Mode

For enterprise environments, WPA3-Enterprise builds on IEEE 802.1X network access control, requiring an external AAA/RADIUS server (such as Aruba ClearPass Policy Manager) to authenticate individual users via EAP methods (EAP-TLS, PEAP):

1. Standard WPA3-Enterprise (128-Bit Mode)

• Uses 128-bit authenticated encryption (AES-CCMP) for user payload data.
• Mandates Protected Management Frames (PMF / 802.11w) for all client associations.
• Requires Protected Management Frames and is commonly deployed with strict server-certificate validation on the client.

2. WPA3-Enterprise 192-bit Mode (CNSA Suite)

Designed specifically for government, defense, financial, and critical infrastructure networks that handle classified or sensitive data, this mode enforces the Commercial National Security Algorithm (CNSA) suite:

• Payload Encryption: 256-bit Galois/Counter Mode Protocol (GCMP-256).
• Management Frame Protection: 256-bit Broadcast Integrity Protocol (BIP-GMAC-256).
• Key Derivation & Hashing: Secure Hash Algorithm (SHA-384).
• Key Exchange & Digital Signatures: Elliptic Curve Diffie-Hellman (ECDH) and Elliptic Curve Digital Signature Algorithm (ECDSA) using the NIST P-384 elliptic curve.
• Authentication Method: Strictly requires EAP-TLS with CNSA-compliant digital certificates (RSA with 3072-bit keys or ECDSA with P-384).

---

Greenfield Security in the 6 GHz Band (Wi-Fi 6E and Wi-Fi 7)

A critical objective for the 6 GHz spectrum was eliminating legacy cryptographic vulnerabilities. Regulatory bodies and the Wi-Fi Alliance established strict greenfield security rules for all 6 GHz operations:

1. Legacy Security Modes are Prohibited: Access points cannot broadcast SSIDs in 6 GHz using WPA2-Personal, WPA2-Enterprise, WEP, or traditional unencrypted open networks.
2. Mandatory WPA3: Networks requiring authentication must utilize WPA3-Personal (SAE) or WPA3-Enterprise with mandatory PMF.
3. Opportunistic Wireless Encryption (OWE / RFC 8110): Open guest networks that do not require credentials cannot be transmitted in cleartext. Instead, open 6 GHz networks must use OWE (Enhanced Open).
   • OWE performs an unauthenticated Diffie-Hellman key exchange during association.
   • Data frames are fully encrypted over the air, preventing passive eavesdropping and packet sniffing in public guest areas, coffee shops, and airports, while maintaining a frictionless guest onboarding experience without passwords.

---

Multi-Pre-Shared Key (MPSK) for Headless IoT Devices

While WPA3-Enterprise and 802.1X provide the gold standard for corporate laptops and smartphones, modern campus networks must accommodate thousands of headless IoT devices—including smart thermostats, security cameras, medical monitors, printers, and handheld barcode scanners. These devices have minimal operating systems and lack 802.1X supplicants, supporting only pre-shared keys.

The Problem with Traditional PSK for IoT

If an enterprise uses a traditional single PSK for all IoT devices:

• Every device shares the exact same password.
• If a single barcode scanner is lost or stolen, an administrator must physically re-enter a new PSK on hundreds or thousands of devices across the campus.
• All IoT devices reside in a single flat broadcast domain, allowing a compromised smart bulb to scan and attack clinical monitoring equipment.

Aruba MPSK Options

Aruba resolves this dilemma through Multi-Pre-Shared Key (MPSK), which gives devices on one SSID different passphrases. There are two common designs:

• MPSK Local: Up to 24 passphrases per SSID, configured in the WLAN profile without an external RADIUS server. It works only with WPA2-PSK-AES.
• MPSK with ClearPass: ClearPass stores a unique passphrase per registered device and returns it during a MAC-authentication exchange, along with the device's role and VLAN. This scales to large IoT fleets.

MPSK and ordinary MAC authentication are mutually exclusive on a WLAN, because MPSK already performs its own MAC-based lookup.

+--------------------+         +-------------------+         +----------------------+
| Headless IoT       |         | Aruba AP          |         | Aruba ClearPass      |
| Device (e.g. Zebra)|         | (AOS 10)          |         | Policy Manager       |
+--------------------+         +-------------------+         +----------------------+
          |                              |                              |
          | 1. Connects with Unique PSK  |                              |
          |----------------------------->|                              |
          |                              | 2. RADIUS Access-Request     |
          |                              |    (Device MAC + SSID)       |
          |                              |----------------------------->|
          |                              |                              | 3. Endpoint Lookup
          |                              |                              |    - Retrieve Device PSK
          |                              |                              |    - Evaluate Role Policy
          |                              | 4. RADIUS Access-Accept      |----------------------|
          |                              |    - Aruba-MPSK-Passphrase   |
          |                              |    - Aruba-User-Role: Medical|
          |                              |    - VLAN-ID: 40             |
          |                              |<-----------------------------|
          | 5. 4-Way Handshake Validated |                              |
          |<============================>|                              |
          |                              |                              |
          | 6. IoT Traffic Placed in     |                              |
          |    Isolated Role & VLAN 40   |                              |
          |----------------------------->|                              |

Step-by-Step ClearPass MPSK Workflow

1. Endpoint Registration: An administrator or automated onboarding workflow registers the IoT device's MAC address in ClearPass Policy Manager. ClearPass assigns or generates a unique MPSK passphrase specifically for that MAC address, along with an assigned user role (e.g., "Medical-Sensor") and VLAN.
2. Client Association: The IoT device attempts to connect to the MPSK-enabled SSID using its unique pre-shared key.
3. RADIUS MAC Authentication Request: The Aruba AP intercepts the connection, extracts the client's MAC address, and sends a RADIUS Access-Request to ClearPass.
4. Credential Retrieval & Authorization: ClearPass queries its endpoint database, locates the client's registered record, and returns a RADIUS Access-Accept packet containing vendor-specific attributes (VSAs):
   • Aruba-MPSK-Passphrase: The specific key assigned to that MAC address.
   • Aruba-User-Role: The assigned firewall security role.
   • Tunnel-Private-Group-ID: The assigned VLAN ID.
5. Handshake Completion & Role Assignment: The AP completes the 4-way handshake using the retrieved MPSK passphrase. The AP then places the device into its designated VLAN and enforces stateful Policy Enforcement Firewall rules defined by the assigned role.

Operational Benefits of MPSK

• Individual Device Revocation: If an IoT device is stolen, an administrator simply disables that single record in ClearPass. No other device on the campus requires rekeying.
• Zero-Trust Micro-segmentation: Devices sharing the same SSID are placed into separate VLANs and security roles based on device profiling.
• Handshake: MPSK uses the WPA2-Personal (PSK-AES) four-way handshake, so devices need only ordinary PSK support.

---

Wireless Security Framework Comparison

---

Common Exam Traps

• Offline Cracking Misconception: Assuming WPA3-Personal is vulnerable to offline dictionary cracking if an attacker captures the initial handshake. SAE eliminates offline dictionary cracking; attackers can only test passwords through active, real-time handshakes that can be detected and rate-limited.
• PMF Status in WPA3: Forgetting that Protected Management Frames (PMF) are strictly mandatory in WPA3. If an older client does not support PMF, it cannot associate with a pure WPA3 SSID.
• 6 GHz Open Network Trap: Believing that standard unencrypted open SSIDs are supported in the 6 GHz band. The 6 GHz standard strictly forbids unencrypted open SSIDs; all open networks in 6 GHz must use Opportunistic Wireless Encryption (OWE).
• MPSK Supplicant Requirements: Believing that MPSK requires client devices to install 802.1X supplicants or digital certificates. MPSK is designed specifically for headless devices that support only standard pre-shared keys.