15 ms·

Hot take: The advantages of WPA3 makes it irrelevant to most consumers and if RasPi saved a dollar by not including it then I am 100% ok with their decision. W

by belval 3y ago

Hot take: The advantages of WPA3 makes it irrelevant to most consumers and if RasPi saved a dollar by not including it then I am 100% ok with their decision. WEP was garbage because it could be cracked in minutes on a laptop. WPA3 is mostly a WPA2 revision that mitigates very expensive attacks.

ianlevesque 3y ago
They didn’t save anything. The hardware they shipped supports it but Broadcom can’t be bothered to release a driver.
- cfiggers 3y ago
  Paying engineers to develop said driver costs at least "a buck."
  - simfree 3y ago
    When the alternative is no connectivity, resulting in a product that gets returned at ever increasing rates, you have to go and fix the issue. Already I have run across a plethora of devices that do not connect to networks in WPA2/WPA3 mix mode. Consumers who are not technically literate will return new hardware they buy that doesn't connect to their WPA3 enabled Wi-Fi network. Their iPhone and laptop connect to it without issue, thus it must be a defective device if your IoT thing won't connect to the existing WPA3 network.
- magicalhippo 3y ago
  So does that mean the Raspberry Pi 5 sold today could enable it at some point in the future, if someone like Broadcom decides to provide that driver?
  - ianlevesque 3y ago
    Yes, it sure does.
kevinday 3y ago
WPA3-only is mandatory if you want to use 6GHz frequencies though. At least for the gear we use, that means if you want 6GHz you either must only have devices that support WPA3 or you have to use a separate SSID for 6GHz clients to use. Fallback to WPA2 isn’t permitted. I appreciate the sentiment, but new devices being sold that still don’t support WPA3 means the adoption of 6GHz is going to be a very slow process. More info here since this is surprising to many: https://www.extremenetworks.com/resources/blogs/wireless-security-in-a-6-ghz-wi-fi-6e-world https://www.extremenetworks.com/resources/blogs/wireless-sec...
- Dalewyn 3y ago
  Are there even computers with 6GHz but no WPA3 if "WPA3 or bust" is part of the 6GHz spec as you said? Sounds to me like if something doesn't support WPA3, it also doesn't support 6GHz which makes the point moot.
  - kevinday 3y ago
    The problem is that if you enable 6GHz on an existing 2.4/5 GHz SSID, you immediately kick off all WPA2 devices. So you have to create a unique SSID for 6GHz devices to use, which is kinda confusing to end users.
    - bestham 3y ago
      It also makes it harder to roam between 6/5/2.4 networks.
- AshamedCaptain 3y ago
  > I appreciate the sentiment, but new devices being sold that still don’t support WPA3 means the adoption of 6GHz is going to be a very slow process. No, it just means the adoption of WPA3 is going to happen at the same speed of 6 Ghz. The point is that every device that supports 6Ghz has to support WPA3.It's not like you could do 6Ghz on your Raspberry Pi but lack of WPA3 blocks you from it.
  - 3y ago
seba_dos1 3y ago
WPA3 (SAE) support enables OWE.
presto8 3y ago
WPA2 uses AES-CCMP-128 which is not efficient (or even feasible) for high data rates as it cannot be parallelized. WPA3 uses GCMP-128 or GCMP-256, which (in the case of 256-bit) is stronger security and also can achieve gigabit level speeds or higher due to being able to parallelize the encryption. WPA2 is susceptible to offline-dictionary attack and the cost is quite low (less than $10), especially with cloud computing. WPA3 is resistant to offline dictionary attack. If an adversary knows the WPA2 passphrase, the adversary can eavesdrop on connections between the AP device and the station device. In comparison, in WPA3, even if an adversary knows the passphrase, the adversary will not be able to decrypt communications between the AP and the station device. The adversary is still able to gain access to the network, but the attack surface area has been reduced. WPA3 uses HMAC-SHA256 for key derivation, whereas WPA2 uses HMAC-SHA1. NIST and other cryptography agencies have recommended against the use of SHA1 in cryptographic systems due to known weaknesses. WPA3 has many advantages over WPA2. In addition, most of the implementation for WPA3 is in software and also available as open source.
- ianpenney 3y ago
  This sounds about right to me, but I’d like to point out the cost barrier differs into unrelated paradigms above/below OSI Layer 2.
- drexlspivey 3y ago
  What are you using your raspberry pi for that is going to be attacked by people who can break SHA-1?
  - deleted 3y ago
    [deleted]
  - jmprspret 3y ago
    What are you using your PC for that is going to be attacked by people who can break TLS?
- gruez 3y ago
  >WPA3 uses HMAC-SHA256 for key derivation, whereas WPA2 uses HMAC-SHA1. NIST and other cryptography agencies have recommended against the use of SHA1 in cryptographic systems due to known weaknesses. AFAIK SHA1 is only broken with respect to preimage/collision attacks. For generating random bits it's still perfectly fine. In other words, sha1 is broken, but not in ways that matter for its use in WPA2.
stefan_ 3y ago
A big thing with WPA3 is that it mandates protected management frames which means you can no longer be randomly deauthenticated by anyone with a WiFi card.
deleted 3y ago
[deleted]

by belval 3y ago

ianlevesque 3y ago

They didn’t save anything. The hardware they shipped supports it but Broadcom can’t be bothered to release a driver.

cfiggers 3y ago
Paying engineers to develop said driver costs at least "a buck."
- simfree 3y ago
  When the alternative is no connectivity, resulting in a product that gets returned at ever increasing rates, you have to go and fix the issue. Already I have run across a plethora of devices that do not connect to networks in WPA2/WPA3 mix mode. Consumers who are not technically literate will return new hardware they buy that doesn't connect to their WPA3 enabled Wi-Fi network. Their iPhone and laptop connect to it without issue, thus it must be a defective device if your IoT thing won't connect to the existing WPA3 network.
magicalhippo 3y ago
So does that mean the Raspberry Pi 5 sold today could enable it at some point in the future, if someone like Broadcom decides to provide that driver?
- ianlevesque 3y ago
  Yes, it sure does.

kevinday 3y ago

WPA3-only is mandatory if you want to use 6GHz frequencies though. At least for the gear we use, that means if you want 6GHz you either must only have devices that support WPA3 or you have to use a separate SSID for 6GHz clients to use. Fallback to WPA2 isn’t permitted. I appreciate the sentiment, but new devices being sold that still don’t support WPA3 means the adoption of 6GHz is going to be a very slow process. More info here since this is surprising to many: https://www.extremenetworks.com/resources/blogs/wireless-security-in-a-6-ghz-wi-fi-6e-world https://www.extremenetworks.com/resources/blogs/wireless-sec...

Dalewyn 3y ago
Are there even computers with 6GHz but no WPA3 if "WPA3 or bust" is part of the 6GHz spec as you said? Sounds to me like if something doesn't support WPA3, it also doesn't support 6GHz which makes the point moot.
- kevinday 3y ago
  The problem is that if you enable 6GHz on an existing 2.4/5 GHz SSID, you immediately kick off all WPA2 devices. So you have to create a unique SSID for 6GHz devices to use, which is kinda confusing to end users.
  - bestham 3y ago
    It also makes it harder to roam between 6/5/2.4 networks.
AshamedCaptain 3y ago
> I appreciate the sentiment, but new devices being sold that still don’t support WPA3 means the adoption of 6GHz is going to be a very slow process. No, it just means the adoption of WPA3 is going to happen at the same speed of 6 Ghz. The point is that every device that supports 6Ghz has to support WPA3.It's not like you could do 6Ghz on your Raspberry Pi but lack of WPA3 blocks you from it.
- 3y ago

seba_dos1 3y ago

WPA3 (SAE) support enables OWE.

presto8 3y ago

WPA2 uses AES-CCMP-128 which is not efficient (or even feasible) for high data rates as it cannot be parallelized. WPA3 uses GCMP-128 or GCMP-256, which (in the case of 256-bit) is stronger security and also can achieve gigabit level speeds or higher due to being able to parallelize the encryption. WPA2 is susceptible to offline-dictionary attack and the cost is quite low (less than $10), especially with cloud computing. WPA3 is resistant to offline dictionary attack. If an adversary knows the WPA2 passphrase, the adversary can eavesdrop on connections between the AP device and the station device. In comparison, in WPA3, even if an adversary knows the passphrase, the adversary will not be able to decrypt communications between the AP and the station device. The adversary is still able to gain access to the network, but the attack surface area has been reduced. WPA3 uses HMAC-SHA256 for key derivation, whereas WPA2 uses HMAC-SHA1. NIST and other cryptography agencies have recommended against the use of SHA1 in cryptographic systems due to known weaknesses. WPA3 has many advantages over WPA2. In addition, most of the implementation for WPA3 is in software and also available as open source.

ianpenney 3y ago
This sounds about right to me, but I’d like to point out the cost barrier differs into unrelated paradigms above/below OSI Layer 2.
drexlspivey 3y ago
What are you using your raspberry pi for that is going to be attacked by people who can break SHA-1?
- deleted 3y ago
  [deleted]
- jmprspret 3y ago
  What are you using your PC for that is going to be attacked by people who can break TLS?
gruez 3y ago
>WPA3 uses HMAC-SHA256 for key derivation, whereas WPA2 uses HMAC-SHA1. NIST and other cryptography agencies have recommended against the use of SHA1 in cryptographic systems due to known weaknesses. AFAIK SHA1 is only broken with respect to preimage/collision attacks. For generating random bits it's still perfectly fine. In other words, sha1 is broken, but not in ways that matter for its use in WPA2.

stefan_ 3y ago

A big thing with WPA3 is that it mandates protected management frames which means you can no longer be randomly deauthenticated by anyone with a WiFi card.

deleted 3y ago

[deleted]