## 3 Attack Surface Description
### Radio Access Control  
In WLAN networks, the Radio Access Control attack surface refers to the vulnerabilities and potential points of exploitation related to the mechanisms that control access to the wireless medium. There are several types of protocols, which are discussed in the following. Protocols  
The initial wireless security protocol, Wired Equivalent Privacy (WEP), served as the standard method for wireless network security from the late 1990s to 2004. WEP, utilizing basic encryption (64-/128-bit), presented configuration challenges and used the RC4 cipher algorithm to encrypt data with a pre-shared key length ranging from 64 to 128 bits [22]. Despite its prevalence as a first-generation security solution, WEP faced vulnerabilities due to limitations in key size, initially at 40 bits and later extended to 104 bits, and its absence of replay detection. To address these shortcomings, users often had to supplement WEP with additional security measures such as Virtual Private Networks (VPNs), IEEE 802.1X, or proprietary solutions to meet their security requirements [23]. Given its recognized insecurities, WEP is no longer considered a secure option and is recommended to be replaced by more modern protocols. The method in [24] provides insight into an easily exploitable method to crack WEP authentication. Generally, there are two modes of authentication in Wi-Fi:  
1. Pre-shared Key Authentication: In this mode, a shared key or passphrase is used for authentication between the client device and the access point. 2. Enterprise: In this mode, each user or device has a unique set of credentials. Typically used in business or enterprise environments, it involves a RADIUS (Remote Authentication Dial-In User Service) server for centralized authentication. It requires individual usernames and passwords or digital certificates for each user or device. There are several protocols that support the above authentication methods. One protocol is WPA (Wi-Fi Protected Access), introduced in 2003, providing enhanced encryption, employing a security protocol known as the Temporal Key Integrity Protocol (TKIP) to achieve stronger (128-/256-bit) security compared to WEP [22]. Alongside WPA2, WPA stands out as one of the most widely utilized protocols today, with the distinction of being compatible with older software, unlike WPA2 [5]. Commonly used in both home and organizational networks, WPA in commercial settings uses 802.1x + EAP for authentication and replaces WEP with TKIP. This mode operates without a pre-shared key, necessitating the use of a RADIUS server for increased security [25]. WPA2, introduced in 2004 as an advanced version of WPA, offers enhanced network security and a simplified configuration utilizing the Advanced Encryption Standard (AES) as its security protocol [22]. This protocol, available in custom versions for individual users and enterprises, is widely regarded as the predominant choice globally. WPA2 uses a 128-bit key size for data encryption, using AES or TKIP [24]. The secure communication established by WPA2 unfolds in four phases. The initial phase involves authentication and pre-authentication, where the access point and the client agree on security policies. Subsequently, a master key is generated in the second phase, followed by the creation of temporal keys in a regular manner during the third phase. The fourth phase utilizes the countermode CBC-MAC Protocol (CCMP) protocol, employing all keys generated in phase three to ensure data integrity and confidentiality. WPA3, a new iteration that surpasses its predecessors, aims to provide a simplified configuration and enhanced security with encryption capabilities ranging from 192 to 256 to 384 bits [22]. Specifically designed to function seamlessly with the latest Wi-Fi 6 networks, devices equipped with WPA3 benefit from advanced security measures, prohibiting expired asset policies, and mandating the use of protected frames (PMFs). Despite these advancements, in WPA3-TM networks, multiple stations remain susceptible to downgrades.