WPA3 announced. Really needed?
According to The Hacker News, here are major improvements :
- WPA3 protocol strengthens user privacy in open networks through individualised data encryption.
- WPA3 protocol will also protect against brute-force dictionary attacks, preventing hackers from making multiple login attempts by
using commonly used passwords.- WPA3 protocol also offers simplified security for devices that often have no display for configuring security settings, i.e. IoT devices.
- Finally, there will be a 192-bit security suite for protecting WiFi users’ networks with higher security requirements, such as
government, defence and industrial organisations.
Thus I think it has some security improvements over WPA2
Anybody knows exactly what is new? features, security improvements, etc...
From what I have been able to gather so far, it appears to be a couple of required new features and a couple of optional features.
- Opportunistic Wireless Encryption (OWE) - required. Based on RFC 8110, this is meant to ultimately displace open wireless networks. This adds a simple encryption to clients without the need to configure a PSK. However the lack of a PSK appears to leave this vulnerable to MitM attacks. Better than transmitting in the clear, but not by much.
- Simultaneous Authentication of Equals (SAE) - required. A modification to the handshake to help prevent dictionary style attacks on PSKs.
- AES 192-bit encryption - optional. A boost from the cryptographic strength used on wireless today (128-bit encryption).
- Device Provisioning Protocol (DPP) - optional. A way to add devices to a secure network easily. Looks to be a replacement of the WPS, which has been broken for a while.
So far, nothing dramatically changing the face of wireless security, rather more enhancements than a new protocol. However it is a new certification from the WFA that devices will have to meet if they want to use WPA3 in their documentation/marketing.
Is it because of Krack attack? I thought patching WPA2 is enough.
Directly no. Indirectly, I would say yes. Consider that WPA2 (802.11i) is nearly a decade and a half old. While (patched) it remains secure today, this is a long time for a security protocol and KRACK caused many people to once again reconsider the role of wireless security.
The WiFi Alliance is simply strengthening the security that currently exists.
I will take a moment to note that unlike previous versions of WPA, WPA3 is not based on an IEEE ammendment to 802.11 (WPA based on draft 802.11i, WPA2 based on 802.11i). I don't doubt that there is discussion of a new IEEE working group to look into updating wireless security, but I am not aware of any formed at the moment.
Is WPA3 really needed because of its security improvements? or is just a "not mandatory" upgrade?
Not mandatory. However, WPA3 does help to strengthen wireless security.
Keep in mind that WPA3 doesn't really seem to be a replacement of WPA2, rather just additional features that the WFA will require to get their certifications.