AES (Advanced Encryption Standard) is a symmetric encryption cipher that plays a central role in modern Wi-Fi security, specifically within the WPA2 and WPA3 protocols. It’s the gold standard for encrypting data over wireless networks, replacing weaker predecessors like TKIP (and its RC4 cipher) to provide stronger, more efficient protection against eavesdropping and tampering.
AES in Wi-Fi Security
In the context of Wi-Fi, AES is integrated into the security framework as follows:
- WPA2 and CCMP:
- AES is the core encryption algorithm used in WPA2 (Wi-Fi Protected Access 2), introduced in 2004 as a significant upgrade over WPA’s TKIP.
- It’s implemented through CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol), which combines:
- Counter Mode (CTR): Encrypts data using AES, turning it into a stream cipher-like mechanism for efficiency.
- CBC-MAC: Provides data integrity and authentication, ensuring the message hasn’t been altered.
- CCMP with AES uses a 128-bit key and a 128-bit block size, making it computationally secure against brute-force attacks with current technology.
- WPA3:
- WPA3, released in 2018, builds on WPA2 and mandates AES with CCMP as the minimum standard, while also introducing enhancements like individualized data encryption (via the SAE handshake) and optional 192-bit AES modes for enterprise networks.
- It keeps AES as the encryption backbone but strengthens key exchange and management to resist offline dictionary attacks.
- Key Features:
- Symmetric Encryption: AES uses the same key for encryption and decryption, negotiated during the Wi-Fi handshake (e.g., 4-way handshake in WPA2).
- Strength: Unlike TKIP’s RC4, AES is resistant to known cryptographic attacks (e.g., key recovery exploits that plagued WEP and TKIP).
- Performance: AES is hardware-accelerated in modern Wi-Fi chipsets, making it faster and less resource-intensive than TKIP, despite being more secure.
How It Relates to Wi-Fi
- Encryption: AES encrypts the data packets transmitted between your device (e.g., laptop, phone) and the Wi-Fi access point, ensuring that even if someone intercepts the signal, they can’t read it without the key.
- Authentication: Through CCMP, AES helps verify that the data comes from a legitimate source and hasn’t been tampered with.
- Standards Compliance: AES meets requirements for FIPS 140-2 (a U.S. government security standard), which is why WPA2-AES and WPA3 are preferred for compliance-heavy environments like businesses or government networks.
AES vs. TKIP
- TKIP: Used in original WPA, relies on RC4 (weaker, older cipher), adds key mixing and MIC for better security than WEP, but still vulnerable to certain attacks (e.g., chopchop, fragmentation).
- AES: Used in WPA2 and WPA3, a block cipher with no known practical weaknesses in Wi-Fi use, far more secure and efficient. TKIP is deprecated; AES is the modern standard.
Practical Context
In a Wi-Fi router’s security settings, you’ll see options like “WPA2-PSK (AES)” or “WPA/WPA2 Mixed Mode (TKIP/AES).” Choosing AES ensures maximum security and compatibility with newer devices. Mixed modes might allow TKIP for legacy support, but this weakens the network. Set WiFi networks to use WPA2 (AES) or WPA2/WPA3 (AES) mixed mode. If the customer only has newer devices we can set it to just WPA3 (AES)