The 802.11 wireless networking standards committee included security from the beginning - the Wired Equivalent Privacy (WEP) specification was part of the original 802.11 standard in 1997. The name captured the ambition: security equivalent to wired networks, where physical access to the cable was necessary to intercept traffic. By 2001, four years after WEP's introduction, three research teams had independently published cryptographic attacks that could recover a WEP key from captured traffic in minutes. By 2007, freely available tools running on consumer hardware could crack a WEP network in under a minute. The standard meant to provide wired-equivalent security had none.
The history of Wi-Fi security is a sequence of cryptographic failures, each replaced by a standard that addressed the previous vulnerability while introducing new ones. WEP fell to RC4 keystream reuse. WPA's TKIP fell to a modified chopchop attack. WPA2's CCMP survived for over a decade before practical attacks - the KRACK attack in 2017, the PMKID attack in 2018 - demonstrated vulnerabilities in its handshake and key derivation. WPA3, introduced in 2019, has had its own post-release vulnerabilities including Dragonblood (2019). The pattern is consistent: cryptographic security for wireless networks is hard, and each generation of researchers has found weaknesses the specification authors missed.
WEP: The Original Failure
WEP used the RC4 stream cipher for encryption and CRC-32 for integrity verification. Both choices were problematic, but the implementation of RC4 was the fatal flaw. RC4 generates a keystream from a key and an Initialization Vector (IV) that is XORed with the plaintext to produce ciphertext. The IV is transmitted in the clear alongside each packet so the receiver can generate the same keystream to decrypt.
WEP's IVs were 24 bits long, meaning there were only 16,777,216 possible IV values. On a busy network, IVs would repeat within hours. When the same key and IV combination produces the same keystream, and an attacker has captured two ciphertexts encrypted with the same keystream, XORing the two ciphertexts together eliminates the keystream and leaves the XOR of the two plaintexts. With knowledge of one plaintext (ARP packets have known structures), the other plaintext and the keystream can be recovered.
The 2001 Fluhrer-Mantin-Shamir (FMS) attack was more targeted: it identified specific "weak IVs" - IV values that leaked information about the key when used with RC4's key scheduling algorithm. By collecting packets with weak IVs and analyzing the first byte of each keystream, the attack could recover the key one byte at a time. The attack required 4-6 million packets with appropriate weak IVs, achievable in hours of traffic capture.
The KoreK attack (2004) and the PTW attack (2007) refined this further, reducing the number of packets needed and relaxing the requirement for weak IVs. The PTW attack (Pyshkin-Tews-Weinmann) could recover a 104-bit WEP key from approximately 40,000 packets with high probability - achievable in under a minute by injecting ARP packets to generate traffic. The aircrack-ng suite implemented all these attacks as a free, maintained toolkit that became the standard reference for wireless security auditing and, unavoidably, for wireless security attacks.
WPA and TKIP: A Stopgap That Also Fell
Wi-Fi Protected Access (WPA), introduced in 2003 as an emergency replacement for WEP, used the Temporal Key Integrity Protocol (TKIP) for encryption. TKIP was designed as a firmware-upgradeable replacement for WEP that could run on existing hardware - the goal was a solution deployable without hardware replacement while the more thorough WPA2 standard was finalized.
TKIP addressed WEP's immediate problems: it used a 128-bit per-packet key derived from a master key and the packet's source MAC address and sequence number, preventing the keystream reuse that broke WEP. It also used Michael, a message integrity code, instead of CRC-32. But TKIP was designed with legacy hardware constraints, and those constraints limited its security margins.
In 2008, Beck and Tews published an attack against WPA-TKIP that adapted the WEP chopchop technique. The attack allowed an attacker to decrypt individual short packets (specifically ARP packets) in about 12-15 minutes and inject limited traffic. In 2009, Ohigashi and Morii extended the attack using man-in-the-middle techniques to make it more practical. TKIP was not catastrophically broken in the way WEP had been - the attacks required significant work and had limited practical impact - but it was no longer trusted as a security foundation.
The Wi-Fi Alliance deprecated TKIP in 2012. WPA2 had been available since 2004, and the 2008-2009 TKIP attacks accelerated migration to WPA2-CCMP, which used AES encryption and was not subject to the same attacks.
WPA2-PSK: The Handshake Attack
WPA2's pre-shared key (PSK) mode - the mode used by home routers and most consumer Wi-Fi - derives the Pairwise Master Key (PMK) from the passphrase using PBKDF2 (Password-Based Key Derivation Function 2) with 4096 iterations of HMAC-SHA1. The PMK is then used in a four-way handshake between the client and access point to establish session keys.
The handshake can be captured passively by an attacker in monitor mode. Once captured, the attacker can conduct offline dictionary and brute-force attacks against the handshake without interacting further with the network. The attack succeeds or fails based entirely on the strength of the passphrase: a truly random passphrase of sufficient length is computationally infeasible to crack offline, but dictionary words, common patterns, and passphrases derived from personal information are crackable with GPU-accelerated tools like hashcat.
The PMKID attack, published by Jens Steube (hashcat author) in 2018, was a significant practical improvement over the four-way handshake approach: it allowed cracking WPA2-PSK without waiting for a client to associate. The PMKID is a value derivable from the PMK and the network's MAC addresses, transmitted by the access point in the first EAPOL frame of the handshake. An attacker can request this value directly from the AP with a single frame, without any client present, and then attempt to crack the PMK offline. Combined with GPU-accelerated dictionary attacks, this made passive handshake capture unnecessary.
KRACK: The Protocol-Level Attack
The KRACK (Key Reinstallation Attack) vulnerabilities, disclosed by Mathy Vanhoef in October 2017, targeted the WPA2 four-way handshake at the protocol level rather than attacking the passphrase. The attack exploited a flaw in the handshake state machine: when an access point retransmits message 3 of the four-way handshake (which the client may legitimately miss due to packet loss), the client reinstalls the session key it had already installed, resetting the nonce used in the encryption. Nonce reuse in CCMP/AES-GCMP allows an attacker to recover keystream and potentially decrypt and forge packets.
KRACK was significant because it was a protocol-level flaw that affected every correct implementation of WPA2, not just misconfigured or weak deployments. Virtually every Wi-Fi client and access point was vulnerable. The severity varied by implementation: CCMP-based connections allowed keystream recovery but not key recovery; GCMP (used in 802.11ac) allowed bidirectional traffic decryption and injection; Linux and Android's wpa_supplicant had an implementation that made the attack trivially effective.
Patches were widely deployed within weeks of the disclosure, and the practical impact was limited by the requirement for the attacker to be in physical proximity. HTTPS encryption (which protects traffic at a layer above Wi-Fi encryption) further reduced the impact of packet decryption. But KRACK demonstrated that WPA2's decade-long record of unbroken protocol-level security had ended, and accelerated the development of WPA3.
WPA3 and Dragonblood
WPA3, finalized in 2018 and required for new Wi-Fi certified devices from 2020, replaced WPA2-PSK's handshake with Simultaneous Authentication of Equals (SAE), also known as Dragonfly. SAE provides forward secrecy - compromise of the passphrase after the fact does not allow decryption of previously captured traffic - and is resistant to offline dictionary attacks because it requires active participation in the handshake for each guess.
Mathy Vanhoef and Eyal Ronen disclosed the Dragonblood vulnerabilities in 2019, finding multiple issues in WPA3's Dragonfly implementation: cache-based side-channel attacks that leaked information about the password encoding, timing side-channels in the SAE commit phase, downgrade attacks that forced WPA3 networks back to WPA2, and denial-of-service vulnerabilities. The Wi-Fi Alliance issued patches and updated certification requirements.
The Dragonblood vulnerabilities were largely addressed by 2020, and WPA3-SAE (when correctly implemented and without transition mode to WPA2) provides substantially stronger security than WPA2-PSK. The transition to WPA3 has been gradual - as of 2024, most consumer deployments still use WPA2 or mixed WPA2/WPA3 transition mode. The field where an attacker can demonstrate clear advantage is still primarily the WPA2 passphrase cracking scenario, which affects the vast majority of deployed access points.