WingNews logo WingNews
top | item 18842996

(no title)

AlyssaRowan | 7 years ago

Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment).

Don't use SAE (which is, indeed, an instantiation of Dragonfly). I have a strong suspicion that the way it is used, there will be a practical attack.

discuss

order

zokier|7 years ago

Or just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box

xenithorb|7 years ago

The problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi

tgsovlerkhgsel|7 years ago

I was unable to find the spec for SAE as used in WPA3, but SAE itself doesn't seem to hash the shared secret into the session key, which would be an easy way to provide resistance to both quantum attackers and random implementation screwups (e.g. bad PRNGs) that defeat the security of the asymmetric parts of the scheme.

Basically, take the original password/secret, derive two secrets A and B, run SAE with A as the secret, get a session key K, then use hash(K|B) as the actual session key.

If they don't have anything like that, I wouldn't be surprised if real-world implementations end up being less secure than up-to-date WPA2.