12.3 WPA3, SAE and Opportunistic Wireless Encryption

Objective 5.3 asks you to understand basic concepts of WPA3 and Opportunistic Wireless Encryption (OWE) and how they improve on WPA2. CWNA-109 is not a cryptographer’s exam. You need the administrator story: what WPA3 mandates, why Simultaneous Authentication of Equals (SAE) is the password-mode upgrade, why OWE exists for public SSIDs, and what 192-bit WPA3-Enterprise is named for. Configure from vendor GUIs using those ideas; do not memorize every elliptic-curve parameter.

What WPA3 changes relative to WPA2

WPA2 can be deployed well (CCMP, 802.1X, validated PEAP) or poorly (TKIP, weak PSK, optional PMF left off). WPA3, as specified by the Wi-Fi Alliance, is largely a policy and consistency upgrade plus new personal and open-network methods:

• Cryptographic consistency. WPA3 disallows WEP and TKIP. You cannot mix SAE with TKIP on the same BSS. The suite is AES-based authenticated encryption, not a buffet of legacy ciphers.
• Protected Management Frames (PMF) are required in every WPA3 mode. WPA2 could treat IEEE 802.11w as optional; WPA3 does not. Unicast robust management frames (deauthentication, disassociation, many Action frames) gain integrity, and broadcast robust management frames use BIP. Section 12.4 expands PMF; here, know that WPA3 without PMF is not WPA3.
• Personal mode is no longer PSK key derivation. WPA3-Personal uses SAE so the password is used to authenticate equals, not to stretch directly into a static PMK that a capture can grind forever.
• Enterprise mode keeps 802.1X but requires PMF, prefers stronger AKM (SHA-256) in WPA3-only mode, and adds server-certificate validation expectations so PEAP-style tunnels are less likely to be blindly trusted.
• 6 GHz (Wi-Fi 6E) requires WPA3 (or OWE for an “open” intent). There is no WPA2-PSK 6 GHz BSS in a conformant design. That regulatory and certification fact is driving client support even when 5 GHz still runs transition mode.

WPA3-Enterprise does not invent a new EAP. Employees still use EAP-TLS or PEAP against RADIUS. The win is mandatory PMF, no TKIP, and optional 192-bit cryptography for agencies that need a consistent high work factor.

Encryption and integrity enhancements (CCMP, GCMP, AES, PMF)

Day-to-day WPA3-Personal still typically uses AES-CCMP-128 for data frames, the same authenticated-encryption family as healthy WPA2, plus mandatory PMF. The headline “WPA3 is a new cipher” is therefore too crude. The headline “WPA3 refuses broken ciphers and requires management-frame protection” is accurate.

GCMP (Galois/Counter Mode Protocol) is AES in Galois/Counter Mode. High-rate PHYs already used GCMP in some 802.11ac/ax/ad contexts. WPA3-Enterprise 192-bit mode specifies GCMP-256 for authenticated encryption, HMAC-SHA384 for key derivation and confirmation, and 384-bit elliptic-curve ECDH/ECDSA for key establishment and signatures. That bundle is meant to match CNSA / Suite B-class guidance so no single primitive is the weak link. At CWNA depth this is awareness: if a government or finance RFP says “WPA3 192-bit,” you know it is GCMP-256 plus the matching hash and curve—not a checkbox next to TKIP, and not something you debug with a home-lab passphrase.

PMF’s integrity protection matters as much as the data cipher. Without PMF, an observer can spoof deauthentication or disassociation and knock stations off a fully encrypted SSID. WPA3’s requirement closes that class of unauthenticated management spoofing for WPA3 clients. Beacons remain in the clear; PMF does not hide the SSID or the RSN IE.

SAE: Dragonfly instead of a grindable PSK

Simultaneous Authentication of Equals (SAE) is the IEEE 802.11 password-authenticated key exchange used by WPA3-Personal. It grew out of 802.11s mesh, where two peers needed to prove knowledge of a password as equals—neither side is a TLS server with a certificate. The cryptographic family is the Dragonfly handshake: commit and confirm messages that produce a fresh PMK for that authentication. That PMK then feeds the ordinary 4-way handshake to install a PTK and GTK. You still see four EAPOL-Key frames after SAE; SAE replaces the PMK derivation, not the 4-way itself.

Three exam properties follow from that design.

Resistance to offline dictionary attacks. In WPA2-PSK, a captured handshake is enough to test passwords at GPU speed with no further help from the AP. In SAE, an observer who records the commit/confirm exchange cannot sit offline and try the whole dictionary against that transcript the way they can with PSK. Guessing the password requires repeated active interaction, one guess per attempt, which an AP can rate-limit. Weak passwords are still a bad idea—online guessing and transition-mode downgrades exist—but the offline capture-and-grind failure mode of WPA2-Personal is the problem SAE was built to close.

Forward secrecy. SAE produces a per-authentication PMK. If someone later learns the BSS password, they cannot decrypt previously captured sessions by reconstructing those old PMKs from the password alone. WPA2-PSK does not give you that property: once the passphrase is known, old handshakes yield old PTKs. Forward secrecy is a major reason to migrate password SSIDs to WPA3-only when clients allow it.

Password is not the PMK. Wi-Fi Alliance language is that WPA3-Personal proves knowledge of the password rather than stretching that password into a static key everyone shares forever. Users can choose more memorable passwords than WPA2 hygiene allowed, but enterprise IoT should still use a high-entropy secret because transition mode and online guessing remain.

Modern SAE password-element derivation uses Hash-to-Element (H2E) to reduce side-channel leakage that affected earlier hunting-and-pecking implementations. Vendors patched those issues; for CWNA, know that H2E is the current method when both peers advertise it, and that you should run current AP and client firmware on WPA3 SSIDs.

WPA3-Personal only versus transition mode. Transition mode lets WPA2-PSK and WPA3-SAE share one BSS and one password. PMF is capable but not required, so antique WPA2 clients can join without 802.11w. WPA3 clients still negotiate PMF. TKIP stays forbidden even in transition mode. Transition is a migration tool. Full SAE benefits—and 6 GHz operation—need WPA3-only, where PMF is required and WPA2-PSK is gone. If an item asks how to get Dragonfly’s offline-resistance and forward secrecy for every client, the answer is WPA3-only, not mixed mode.

OWE for public and guest open networks

Classic open authentication means no 802.11 AKM and no encryption. Captive portals then dump HTTP, DNS, and session cookies onto a medium anyone can record. Opportunistic Wireless Encryption (OWE), marketed as Wi-Fi Enhanced Open, keeps the no-password user experience but performs an unauthenticated Diffie-Hellman exchange during association. Each STA and the AP derive an ephemeral PMK and then run a 4-way handshake, so unicast data is encrypted with a per-session key.

OWE does not authenticate the network. A hostile AP can still offer OWE. The win is passive sniffing resistance on guest and public SSIDs, not 802.1X identity. Combine OWE with a captive portal and client isolation when you need an acceptable-use click-through; do not pretend OWE is employee access control.

6 GHz networks that would have been “open” on 2.4/5 GHz should use OWE (or WPA3) rather than true open. OWE transition mode uses a visible open BSS plus a hidden OWE BSS advertised by an OWE Transition element so older clients still join unencrypted while new clients encrypt. As with WPA3-Personal, transition is interoperability, not the end state.

WPA3-Enterprise 192-bit: brief awareness

Do not turn this into a configuration lab. WPA3-Enterprise 192-bit (CNSA-class) is an optional mode that locks the entire stack to GCMP-256, SHA-384, and 384-bit elliptic curves so mixed 128-bit leftovers cannot become the weakest link. It still uses 802.1X and certificates. Most hospitals, campuses, and offices will run WPA3-Enterprise (non-192) or WPA2-Enterprise with PMF while they migrate. Know the name, the cipher (GCMP-256), and the audience (high-sensitivity networks). Know that it is not SAE, not OWE, and not a replacement for RADIUS.

When you choose a profile: employees → WPA3-Enterprise (or WPA2-Enterprise with PMF required) and EAP-TLS if PKI exists; password IoT → WPA3-only SAE when clients allow it, else a scoped WPA2-PSK with a long random key; public Wi-Fi → OWE plus portal and isolation, not WEP, not a shared staff PSK printed on a tent card.