WPA and TKIP: Why the Wi-Fi Stopgap Was Retired

WPA with TKIP was designed as a bridge. WEP had been broken conclusively, replacement hardware was years away, and the industry needed something that would run on the radio chips already deployed. TKIP met that constraint and only that constraint, which is why it was obsolete almost as soon as it shipped and why selecting it today is a finding rather than a configuration choice.

What WEP got wrong

WEP used RC4 with a 24-bit initialization vector prepended to a static shared key. Three failures compounded. The IV space was small enough that values repeated on a busy network within hours, and repeated IVs with the same key expose the keystream. The key never changed, so every captured packet contributed to the same analysis. And the integrity check was a CRC, which an attacker can recompute after modifying a packet — detection of accidents, not of tampering.

The result was a protocol recoverable in minutes with passive capture. Note the general lesson the exam likes: a CRC is error detection, never an integrity control against an adversary.

What TKIP changed

TKIP kept RC4 so existing hardware could run it, and fixed the surrounding construction.

Per-packet key mixing derives a unique key for every frame from the base key, the transmitter address, and a sequence counter, so no two packets share a keystream even when the underlying key is the same.

A 48-bit sequence counter replaced the 24-bit IV, enlarging the space enormously and doubling as replay protection — frames arriving out of sequence are discarded.

Michael, a message integrity check, replaced the CRC. It is cryptographic rather than a checksum, though it was deliberately weakened to run on legacy processors, and it carries countermeasures that shut the link down briefly when failures are detected.

Together these closed the WEP attacks. They did not produce a strong protocol, because the foundation was still RC4 and the integrity check was still constrained by 1990s hardware. Attacks against TKIP followed within a few years, allowing limited packet injection and decryption.

What replaced it

WPA2 made CCMP with AES mandatory. This was a clean design rather than a retrofit: AES in counter mode for confidentiality, CBC-MAC for integrity, no RC4 anywhere. It required new hardware, which is exactly why TKIP existed in the interim.

WPA2 held up well, with its notable weakness being the four-way handshake — the key reinstallation attack targeted that, and it was fixed in firmware rather than by replacing the protocol. Its other limitation is the pre-shared key mode: an attacker who captures a handshake can attempt offline password cracking, so a weak passphrase is the whole defense.

WPA3 addresses that with Simultaneous Authentication of Equals, which replaces the pre-shared key handshake with a password-authenticated key exchange. Offline cracking of a captured handshake becomes infeasible, and forward secrecy means a later password compromise does not decrypt earlier captured traffic. WPA3 also adds protected management frames as a requirement, which blocks the deauthentication attacks used to force clients off a network, and Opportunistic Wireless Encryption to encrypt open guest networks.

Configuring in practice

Select WPA3 where every client supports it, and WPA2 with AES-CCMP otherwise. Avoid mixed WPA2/WPA3 transitional mode longer than a migration requires, because it accepts the weaker option and an attacker will choose it.

Never enable TKIP, including in a mixed mode that permits it. Beyond the security problem, its presence caps the network at legacy data rates on many access points — enabling TKIP on a modern network degrades throughput for every client, which is often the argument that finally gets it turned off.

For enterprise networks, use the 802.1X mode rather than a shared passphrase, so each user authenticates individually and access can be revoked per user — the model described under 802.1X port-based authentication. Disable WPS entirely; its PIN is brute-forceable and it undermines whatever encryption sits above it.

Troubleshooting note: hiding the network name provides no security, since the SSID appears in client probe requests regardless, and it complicates support. Signal quality problems are a separate matter from encryption — measure them with RSSI readings rather than changing security settings and hoping.

Exam angles

Know the progression WEP to WPA/TKIP to WPA2/CCMP-AES to WPA3/SAE, and what each fixed. Identify TKIP as a temporary RC4-based retrofit for legacy hardware, now deprecated. Know CCMP with AES as the WPA2 standard and SAE as the WPA3 handshake that defeats offline cracking. Recognize protected management frames as the WPA3 defense against deauthentication, and 802.1X enterprise mode as preferable to a shared passphrase.