Wi-Fi & 802.11 · Study deck
Wi-Fi Security: Access and Segmentation Controls
One shared Wi-Fi key can turn a lost sensor into a fleet-wide breach.
Radio Remi is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.
- Explain: An attacker who flips a chosen delta $\Delta$ in ciphertext can compute the corresponding CRC delta, so the receiver can accept a predictably modified plaintext without the attacker knowing the secret key.
- Explain: SAE resists the offline dictionary attack (a captured exchange cannot be replayed against a wordlist) and adds forward secrecy, so a later passphrase leak does not decrypt previously captured traffic.
Major section
Start With the Wireless Story
A support worker should not need one shared secret for every device.
- An access point is the local radio device that joins Wi-Fi devices to a network.
- Provisioning is the setup path that gives a device the right network details and its own trust record.
- The later records and checks test each part of that claim.
Major section
Start With the Wireless Story (continued)
A safe path must recover without falling back to a common password or an open setup mode.
- The join must prove who the device is, who may set it up, and what it can reach.
- A shared secret is easy to start, but one leak can affect many devices.
- Recheck after code change.
Major section
Start With the Wireless Story (continued)
The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.
- A unique identity is safer to revoke, yet it needs more care and support.
- Recheck after router change.
- Recheck after owner change.
Major section
Security Provisioning Record
Authentication strength alone does not cover secret storage, recovery, segmentation, updates, or support.
- The accepted limits and retest trigger connect initial setup to the operational controls needed after ownership or network conditions change.
Major section
Authentication Mode Review
Wi-Fi authentication is not one thing.
- The key can be recovered from ordinary captured traffic in minutes.
- WEP is broken for every use — if a device supports only WEP, treat that as a hardware end-of-life signal, not a setting to tune.
- The IV must travel in the frame so the receiver can regenerate $Z$.
Major section
Authentication Mode Review (continued)
RC4 expands that seed into keystream $Z$, and encryption is the stream-cipher operation $C=P\oplus Z$.
- A 24-bit space has only $2^{24}$ values.
- Merely avoiding one immediately repeated IV does not repair the construction.
- CRC detects accidental transmission errors, but it is linear and unkeyed.
- ARP frames have short, predictable fields.
Major section
Authentication Mode Review (continued)
An attacker who flips a chosen delta $\Delta$ in ciphertext can compute the corresponding CRC delta, so the receiver can accept a predictably modified plaintext without the attacker knowing the secret key.
- Confidentiality and integrity therefore fail for different but reinforcing reasons.
- An attacker can replay a captured ARP request so the network emits many related ARP responses, rapidly collecting IVs and RC4 samples instead of waiting for ordinary use.
- WPA with TKIP was an emergency compatibility bridge.
Major section
Authentication Mode Review (continued)
The failure sequence is: observe a valid frame, stimulate repeatable traffic, collect public IV/ciphertext pairs, recover the shared key statistically, then decrypt or inject traffic.
- Those changes made simple WEP-style reuse harder, but Michael was deliberately lightweight and weak.
- TKIP is now legacy, not a safe fallback: require AES-CCMP or an approved modern WPA2/WPA3 suite and remove WEP/TKIP rates and modes from acceptance tests.
- SAE resists the offline dictionary attack (a captured exchange cannot be replayed against a wordlist) and adds forward secrecy, so a later passphrase leak does not decrypt previously captured traffic.
Deck summary
Key takeaways
A support worker should not need one shared secret for every device.
- A safe path must recover without falling back to a common password or an open setup mode.
- The story runs from onboarding and credentials through WPA mode, identity proof, key rotation, fleet recovery, and deprovisioning, because a device that is easy to join must also be safe to operate.
- Authentication strength alone does not cover secret storage, recovery, segmentation, updates, or support.
- Wi-Fi authentication is not one thing.
Retrieval practice
Recall check
Radio Remi says: answer from memory, then check your reasoning.
Q1A team wants every deployed sensor to share one Wi-Fi password because it is easy to install. What is the strongest review response?
Show answer
Answer: A A fleet-wide shared Wi-Fi password needs a decision on rotation, lost-device response, segmentation, and per-device identity.
Print reference
Answers
Answer key.
- A · A fleet-wide shared Wi-Fi password needs a decision on rotation, lost-device response, segmentation, and per-device identity.