After the announcement of KRACK and the confirmation that WPA2 was not as secure as we imagined, the main players in the market responded with patches and updates for a wide number of WiFi products, but beyond the emergency, the truth is that the only way to root out its vulnerabilities is creating a new protocol. That puts WPA3 on the table, announced by the WiFi Alliance earlier this week, which will completely eliminate weak points such as brute force attacks and the lack of encryption for links on open public networks.
If anyone expected computer security to allow a brief respite in 2018, they definitely were left wanting after what happened with Meltdown and Spectre. That desire arises from the real beating that 2017 gave us, and especially from the announcement of KRACK, an attack that interferes with the four-way handshake of WPA2 networks and allows access to its traffic without knowing the original password. Although the most serious aspects of KRACK have already been corrected and WPA2 support will continue for a long time, the decision to replace it with a superior standard has already been made. The WiFi Alliance took advantage of the activity at CES 2018 (which will extend until next Friday) to present WPA3, available this same year.
What does WPA3 bring?
What exactly will it bring? First, WPA3 will raise data encryption from 128 to 192 bits, strengthening the security of networks in all cases. Then we find limits on the number of attempts a device can make to connect to a network. The introduction of a new handshake will provide immunity against brute force attacks (read “dictionaries”), even when the configured password is weak. Another goal of the WiFi Alliance is to greatly simplify the process of configuring security on devices without interfaces, or with very limited environments. Finally, WPA3 will enable individual encryption of links on public and/or open networks, so that connections between devices and the router will always be protected.
The slow transition
The rest will depend on manufacturers and software developers, who will surely offer updates on compatible products and won't hesitate to launch new modems or routers to the market. Anyway, the feeling is that the transition from WPA2 to WPA3 will be quite slow, despite the crisis generated by KRACK. The announcement of WPA3 is very good news, but at the end of the day, the most likely thing is that users will have to acquire extra hardware.
