Sign in Subscribe
CCNA

Comparing Wireless Encryption Types for Beginners

This post compares the major wireless encryption types including WEP, WPA, WPA2, and WPA3, covering the strengths and weaknesses of each. It explains key concepts like TKIP, AES, CCMP, and SAE in beginner-friendly terms. Readers learn which encryption standard to use and which to avoid on modern ne

Jay Whale

• 3 min read
Comparing Wireless Encryption Types for Beginners

When you connect to a Wi-Fi network, your data doesn't travel through a physical cable. It floats through the air as radio waves, which means anyone nearby with the right tools could potentially intercept it. Wireless encryption is what prevents that from happening. It scrambles your data so that only authorized devices can read it.

For the CCNA exam, you need to understand the major wireless encryption types, how they differ, and why some are considered obsolete while others are the current standard. Let's walk through each one.

WEP: The Original (and Broken) Standard

Wired Equivalent Privacy (WEP) was introduced in 1997 as part of the original 802.11 standard. The goal was to give wireless networks security equivalent to a wired connection. Unfortunately, it fell far short of that goal.

WEP uses the RC4 stream cipher with either a 40-bit or 104-bit key. The problem is in how it generates the keystream. WEP uses a short, 24-bit Initialization Vector (IV) that is transmitted in plaintext alongside the data. Because the IV space is so small, it repeats frequently. An attacker can capture enough packets to reconstruct the encryption key in minutes using freely available tools.

Bottom line: WEP is cryptographically broken. You should never use it on any network. Many modern access points no longer even support it.

WPA: A Better Patch, Not a Perfect Fix

🛡️
What I run for endpoint protection: Bitdefender is my current antivirus of choice. I've tried most of them over the years and keep coming back to this one. Detection rates are consistently top-tier in independent testing, and it doesn't hammer your system performance the way some security tools do. Does its job quietly in the background — which is exactly what you want.

Wi-Fi Protected Access (WPA), introduced in 2003, was designed as a stopgap while a stronger long-term standard was developed. It replaced WEP's static key system with TKIP (Temporal Key Integrity Protocol), which dynamically generates a new 128-bit key for every packet. This dramatically reduced the risk of IV-related attacks.

WPA was a significant improvement over WEP, but TKIP was built on top of the same RC4 cipher. As a result, it inherited some of RC4's fundamental weaknesses. WPA is now considered deprecated and should also be avoided on modern networks.

WPA2: The Long-Standing Standard

WPA2, ratified in 2004 under the IEEE 802.11i standard, replaced RC4 and TKIP entirely with AES (Advanced Encryption Standard) and a new protocol called CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol). AES is a block cipher considered cryptographically strong, and it is still trusted by security professionals today.

WPA2 comes in two modes:

  • WPA2-Personal (PSK): Uses a pre-shared key. Everyone on the network uses the same passphrase. This is common in homes and small offices.
  • WPA2-Enterprise: Integrates with a RADIUS authentication server (using 802.1X). Each user authenticates individually with their own credentials. This is the standard in corporate environments.

WPA2 has been the recommended wireless security standard for most of the past two decades. While vulnerabilities like KRACK (Key Reinstallation Attack) have been discovered, patched devices remain well-protected in most environments.

WPA3: The Current Best Practice

WPA3, introduced in 2018, addresses remaining weaknesses in WPA2. The most important improvement is SAE (Simultaneous Authentication of Equals), which replaces the PSK handshake and protects against offline dictionary attacks. WPA3 also provides forward secrecy, meaning that even if a key is compromised, past sessions cannot be decrypted.

For the CCNA exam, WPA3 awareness is helpful but WPA2 remains the primary focus.

Quick Comparison

Protocol  | Cipher       | Key Mgmt  | Security Status
----------|--------------|-----------|----------------
WEP       | RC4          | Static    | Broken - do not use
WPA       | RC4 + TKIP   | Dynamic   | Deprecated
WPA2      | AES + CCMP   | Dynamic   | Current standard
WPA3      | AES + SAE    | Dynamic   | Recommended

Which Should You Use?

If you are configuring any Wi-Fi network today, use WPA2 at minimum. If your equipment supports it, use WPA3. For enterprise environments, always pair WPA2 or WPA3 with 802.1X authentication and a RADIUS server rather than relying on a shared passphrase.

Avoid WEP and WPA entirely. They are not acceptable security controls on any modern network, and using them would expose users to serious risk.

What's Next

Now that you understand wireless encryption, the next step is understanding how wireless authentication actually works in a network, specifically how 802.1X and RADIUS fit together to verify users before granting access. We will cover that in the next post in this series.

🔧
If you're setting up or auditing a wireless network, Bitdefender can help enforce security policies and detect threats at the endpoint level. Pair it with a network monitor like PRTG to get visibility into what's actually happening across your wireless infrastructure. Bitdefender, PRTG Network Monitor and Wireshark.

Tools and resources for this topic