Wi-Fi Alliance to enhance WPA security - News Review

Rethink IT, March, 2004

The Wi-Fi Alliance created the WPA specification as a stopgap measure as the market waited for the 802.1 I i security standard, but it seems to have taken on an independent life of its own, fuelling criticisms that the industry body is usurping power from the true standards organizations.

The Alliance will release version 2.0 of WPA later this year, around the same time that 802.1 I i is fully ratified, and it says the enhancements are targeted mainly at corporate requirements. The group also said that 175 products have now been certified under its WPA testing program.

The WPA2 specification will bring WPA in full alignment with 802.1 I i, which is still expected to be ratified this year, though not by midyear as had been hoped--hence the need for the Wi-Fi Alliance's update. New features will include support for Advanced Encryption System (AES) keys in the form of the CCMP protocol, which addresses most of the cryptographic weaknesses remaining in WPA. There will also be full support for EAP (Extensible Authentication Protocol) and for automated generation of keys.

"WPA has proven to be a very secure and easily implemented security solution. WEP should only be used when a more secure wireless LAN security solution is not available," the Alliance said in a statement.