5 ms·
Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment). Don't use SAE (which is, indeed, an instanti
by AlyssaRowan 8y ago
Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment).
Don't use SAE (which is, indeed, an instantiation of Dragonfly). I have a strong suspicion that the way it is used, there will be a practical attack.
- zokier 8y agoOr just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box
- xenithorb 8y agoThe problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi
- zokier 8y agoStill, I imagine lot more devices support WPA2-EAP over WPA3-EAP that OP recommended.
- deleted 8y ago[deleted]
- mey 8y agoCan you provide any more info on your concerns about SAE?
- zokier 8y agoHere is some background reading: https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=6942145 https://news.ycombinator.com/item?id=7017160 https://news.ycombinator.com/item?id=7017160
- tgsovlerkhgsel 8y agoI was unable to find the spec for SAE as used in WPA3, but SAE itself doesn't seem to hash the shared secret into the session key, which would be an easy way to provide resistance to both quantum attackers and random implementation screwups (e.g. bad PRNGs) that defeat the security of the asymmetric parts of the scheme. Basically, take the original password/secret, derive two secrets A and B, run SAE with A as the secret, get a session key K, then use hash(K|B) as the actual session key. If they don't have anything like that, I wouldn't be surprised if real-world implementations end up being less secure than up-to-date WPA2.