Security · Topic 5 of 13
Wireless Security and Authentication
Compare WEP, WPA, WPA2 and WPA3 encryption, TKIP and AES, personal and enterprise modes, and the RADIUS, TACACS+ and Kerberos authentication methods.
- 4 min
- Includes a diagram
- WEP is broken and WPA with TKIP is deprecated.
- WPA2 uses AES with CCMP. WPA3 uses SAE and is the strongest.
- Choose AES over TKIP.
What it is
Wireless traffic travels through the air, so anyone nearby can capture it. Wireless security protocols encrypt that traffic and control who may join. The exam asks you to compare the generations and to know which authentication systems support them.
How it works
Protocol generations
| Protocol | Encryption | Status |
|---|---|---|
| WEP (Wired Equivalent Privacy) | RC4 with weak keys | Broken. Do not use |
| WPA (Wi-Fi Protected Access) | TKIP (Temporal Key Integrity Protocol) | Deprecated. A stopgap for old hardware |
| WPA2 | AES (Advanced Encryption Standard) with CCMP | Widely used and still acceptable when set up well |
| WPA3 | AES, with stronger key exchange | Current best choice |
TKIP was designed to patch WEP on existing hardware, but it has known weaknesses. AES with CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) is the stronger option used by WPA2. Choose AES whenever the router offers a choice.
WPA3 replaces the pre shared key handshake with Simultaneous Authentication of Equals (SAE). This makes it far harder to guess a password offline from captured traffic. WPA3 also adds protection for open networks, using a feature that encrypts traffic even without a password.
Personal and enterprise modes
| Mode | Authentication | Typical use |
|---|---|---|
| Personal | A shared passphrase called a pre shared key (PSK) | Homes and small offices |
| Enterprise | Individual sign in checked by an authentication server using Institute of Electrical and Electronics Engineers (IEEE) 802.1X | Companies |
Personal mode shares one key with everyone, so a leaked passphrase affects all users, and changing it affects every device. Enterprise mode gives each user their own credentials, which can be revoked individually. 802.1X uses the Extensible Authentication Protocol (EAP) to carry the sign in between the device and the server.
Authentication methods
RADIUS. Remote Authentication Dial In User Service is a central server that checks credentials for network access, such as Wi-Fi and virtual private network (VPN). It typically uses User Datagram Protocol (UDP) ports 1812 for authentication and 1813 for accounting. Enterprise Wi-Fi commonly uses RADIUS.
TACACS+. Terminal Access Controller Access Control System Plus is also a central authentication, authorisation and accounting service. It is common for administrator access to network devices such as routers and switches. It uses Transmission Control Protocol (TCP) port 49, and it keeps the three functions separate.
Kerberos. This is a ticket based system used by Active Directory. A user proves their identity once and receives tickets to access services without sending the password again. It uses port 88 (both TCP and UDP).
Multifactor authentication. Adding a second factor, such as an app code, protects a network login even if a password leaks.
Compatibility and mixed mode
Many routers offer a transition mode that accepts both WPA2 and WPA3 clients. This keeps older devices working, but the network is only as strong as its weakest allowed setting. Where every device supports WPA3, use WPA3 only.
Some very old devices support only WEP or WPA, and the right answer is to replace or isolate them rather than weaken the whole network.
Open networks and captive portals
An open network has no encryption. A captive portal is a web page that appears before the user gets access, often for terms or a voucher code. It controls access but does not encrypt traffic, so a user should add a VPN on public Wi-Fi.
For a home router, the best answer is WPA3, or WPA2 with AES if WPA3 is not supported. For a company that wants individual accounts, the answer is Enterprise mode with a RADIUS server.
What to remember for the exam
- WEP is broken and WPA with TKIP is deprecated.
- WPA2 uses AES with CCMP. WPA3 uses SAE and is the strongest.
- Choose AES over TKIP.
- Personal mode uses a shared PSK. Enterprise mode uses 802.1X and a server.
- RADIUS is a central server for network access, on UDP 1812 and 1813.
- TACACS+ is used for device administration, on TCP 49.
- Kerberos uses tickets and is used by Active Directory, on port 88.
- Open networks are not encrypted, even with a captive portal.
Common mistakes
Picking WPA with TKIP for a new network. It is deprecated. Use WPA2 with AES or WPA3.
Mixing up RADIUS and TACACS+. RADIUS is typical for user network access. TACACS+ is typical for administrators of network devices.
Thinking a captive portal encrypts traffic. It only gates access.
Using Personal mode in a large company. One shared passphrase cannot be revoked per person.
Check yourself
Which wireless protocol uses SAE?
WPA3.
Which service is typically used with Enterprise Wi-Fi to check each user?
A RADIUS server, through 802.1X.
Which encryption pairs with WPA2?
AES using CCMP.
Topic 5 of 13 in Security
Test yourself on Security
The full CompTIA A+ 220-1202 question bank has 835 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.