GPEN · Question #11
Which of the following statements are true about WPA? Each correct answer represents a complete solution. Choose all that apply.
The correct answer is A. WPA-PSK converts the passphrase into a 256-bit key. B. WPA provides better security than WEP. C. WPA-PSK requires a user to enter an 8-character to 63-character passphrase into a wireles s client. D. Shared-key WPA is vulnerable to password cracking attacks if a weak passphrase is used. All four statements about WPA are accurate, covering its key derivation mechanism, security advantages over WEP, passphrase length requirements, and vulnerability to weak passphrases.
Question
Which of the following statements are true about WPA? Each correct answer represents a complete solution. Choose all that apply.
Options
- AWPA-PSK converts the passphrase into a 256-bit key.
- BWPA provides better security than WEP.
- CWPA-PSK requires a user to enter an 8-character to 63-character passphrase into a wireles s client.
- DShared-key WPA is vulnerable to password cracking attacks if a weak passphrase is used.
How the community answered
(34 responses)- A100% (34)
Why each option
All four statements about WPA are accurate, covering its key derivation mechanism, security advantages over WEP, passphrase length requirements, and vulnerability to weak passphrases.
WPA-PSK uses PBKDF2 (with HMAC-SHA1) to derive a 256-bit Pairwise Master Key (PMK) from the passphrase, the SSID, and SSID length, replacing WEP's static key approach.
WPA replaced WEP's broken RC4 static key implementation with TKIP and per-packet key mixing, making it significantly more resistant to the IV reuse and key recovery attacks that broke WEP.
The WPA-PSK specification requires a passphrase between 8 and 63 ASCII characters, which is then fed into the PBKDF2 key derivation function to generate the PMK.
Because the PMK is derived directly from the passphrase, a short or common passphrase allows an attacker who captures the 4-way handshake to perform an offline dictionary or brute force attack.
Concept tested: WPA-PSK security features and vulnerabilities
Source: https://learn.microsoft.com/en-us/windows/win32/nativewifi/wpa-psk
Topics
Community Discussion
No community discussion yet for this question.