What's New in Security: WPA (Wi-Fi Protected Access)

WPA is wireless security with greater protection than WEP. Most wireless networks should use either WEP or WPA. WPA-PSK is not much more difficult to configure than the older WEP, but is not available on some older products. All computers, access points, and wireless adapters must use the same type of security. See your user manuals for configuration instructions.

WPA operates in either WPA-PSK mode (aka Pre-Shared Key or WPA-Personal) or WPA-802.1x mode (aka RADIUS or WPA-Enterprise). In the Personal mode, a pre-shared key or passphrase is used for authentication. In the Enterprise mode, which is more difficult to configure, the 802.1 x RADIUS servers and an Extensible Authentication Protocol (EAP) are used for authentication. The enhanced WPA2 uses Advanced Encryption Standard (AES) instead of Temporal Key Integrity Protocol (TKIP) to provide stronger encryption mechanism.

Advantages of WPA

• Provides extremely strong wireless security for the 2003 computing environment.
• Adds authentication to WEP's basic encryption.
• Has backward compatible WEP support for devices that are not upgraded.
• Integrates with RADIUS servers to allow administration, auditing, and logging.

Disadvantages of WPA

• Except when using with the preshared key (WPA-PSK), complicated setup is required, unsuitable for typical home users.
• Older firmware usually will not be upgraded to support it.
• Incompatible with older operating systems such as Windows 95.
• Greater performance overhead than WEP.
• Remains vulnerable to Denial of Service attacks.

Facts About WPA

• To use WPA, all computers, access points, and wireless adapters must have WPA software.
• WPA was introduced in 2003. To run WPA between two computers both must have WPA software, and all access points and wireless adapters between them, as well. Equipment older than 2003 will often not be upgradable.
• WPA has two significant advantages over WEP:
  • An encryption key differing in every packet. The TKIP (Temporal Key Integrity Protocol) mechanism shares a starting key between devices. Each device then changes their encryption key for every packet. It is extremely difficult for hackers to read messages — even if they've intercepted the data.
  • Certificate Authentication (CA) can be used, blocking a hacker's access posing as a valid user.
• WPA computers will communicate with WEP encryption, if they cannot use WPA with a particular device.
• A Certificate Authority Server is part of the recommended configuration, to allow WPA computers assurance that the computers with whom they share keys are who they claim.
• Since WPA adds to packet size, transmission takes longer. The encryption and decryption are slower for devices using software, rather than dedicated WPA hardware.
• The EAP types supported by WPA-Enterprise are

  o EAP-TLS
  o EAP-TTLS/MSCHAPv2
  o PEAPv0/EAP-MSCHAPv2
  o PEAPv1/EAP-GTC (Cisco-based implementation)
  o EAP-SIM
  

NETGEAR Products Supporting WPA

• WPA-Personal includes WPA-PSK (pre-shared key). This is a simpler version that does not support 802.1x and requires a separate RADIUS server for mutual authentication. This includes WEP enhancements noted below.
• WPA-Enterprise includes all of the features of WPA-PSK plus support for 802.1x RADIUS authentication and is appropriate in those cases where a RADIUS server is deployed.
  

NETGEAR Products That Do Not and Will Not Support WPA

• Older products will not be in the "Product Finder" on the left of the NETGEAR Marketing Site.
• ME101
• WGE101
• WG602 (WG602v2, however, does have WPA)

Read Instructions on how to Configure Wireless Security (WEP/WPA/Access list). Instructions are also included on the User Manuals and Reference Manuals for wireless products (available on the Product page on this site as downloads).

Doc: N101190.asp Oct. 25, 2004