# Understanding Server Authentication in WPA3 Enterprise
## 1 Introduction  
In April 2018, the Wi-Fi Alliance published the technical details of the WPA3 certification program for Wi-Fi devices. WPA3 updates the WPA2 program, which had been specified more than 14 years earlier, and includes several capabilities aimed at enhancing the security properties of Wi-Fi networks. In December 2019, the Wi-Fi Alliance published version 2 of WPA3 [1]. This new version addresses, amongst other things, one of the crucial weaknesses of WPA2 that was not addressed in the first version of WPA3 and that affects _enterprise_ Wi-Fi networks--i.e., networks in which each user has personalized credentials for all of his/her devices; in many practical deployments, a device may easily be attacked by fraudulent access points claiming to have the name of the targeted Wi-Fi network (_evil twins_) [2]. The impact of a successful attack of this kind depends on the specific attack scenario and may range from the evil twin acting as a man-in-the-middle for all the network traffic of the connected device to the evil twin collecting traffic sufficient for the offline guessing of the network credentials of the user that owns the device [3; 4; 5; 6; 7]. The weakness exploited in this class of attacks consists of a mismatch between the _assumptions_ made in the WPA2 specification and the _reality_ of its practical deployment. WPA2 assumes that each device needs be configured, before connecting, with certain identity information tailored to the specific enterprise network of interest, and that the device verifies at the connection time that the identity claimed by the network matches the identity specified in the configuration [1; 8; 9]. Devices that do not satisfy these requirements may be tricked into connecting to an evil twin that claims to have the identity of any enterprise network (as illustrated in more detail below) [10]. The problem is that insecure configurations of devices that connect to enterprise networks are quite commonplace. A recent survey with almost 1000 users of academic environments reports that more than 75% or respondents either do not know the name of the authorization server or do not even know that there is an authorizationserver to be associated with the SSID of the enterprise network [11]. According to the same survey, only half of the respondents configured their devices correctly, by means of an automatic tool, and 40% of 311 configuration guides published by 69 academic institutions contain indications that lead or may lead to an insecure configuration. Other surveys on the topic of management of personal devices in enterprise Wi-Fi environments identified the same problem [12; 13; 14; 15]. The risks introduced by evil twins have become more and more relevant since 2004, when WPA2 was specified, for three key reasons. First, network credentials have become very valuable to attackers, because virtually all enterprises have migrated to single sign-on architectures, and thus network credentials often unlock access to all enterprise services. Second, everyone is now permanently carrying a Wi-Fi-enabled smartphone, which often contains the user's enterprise credentials and connects to Wi-Fi networks _automatically_--e.g., while the user is walking with a smartphone in his/her pocket. Third, attacks aimed at stealing network credentials may occur potentially anywhere and are virtually impossible to detect; they are executed automatically, in less than a second of proximity to an evil twin (which may easily be hidden within a small bag, for example) and without any need to involve the device owner in a working session [10]. WPA3 version 2 thus addresses a long-awaited need for better defensive mechanisms in enterprise Wi-Fi networks [2]. In this work, we discuss the defensive power and potential impact of the various options available, along with the corresponding security maintenance cost tradeoffs. We are not aware of any similar analysis.