WPA2-Enterprise AES-CCMP128 vs WPA3-Enterprise AES-CCMP128

[sandeepsingh3200]

Hello,

I am working on starting the process of upgrading to WPA3-Enterprise. Currently we have devices that won’t support  WPA3 192 bit. I do have the option to go to WPA3-Enterprise AES-CCMP128. I am currently running WPA2-Enterprise AES-CCMP128. Is there any security benefit of moving to  WPA3-Enterprise AES-CCMP128?

[Rich R]

Short answer no - but check out similar recent question at https://community.cisco.com/t5/wireless/windows-10-showing-as-wpa2-enterprise/m-p/4963374#M263219 where JPavonM explains why they're basically the same.

[Rasika Nayanajith · Accepted solution]

WPA3 mandates "PMF- Protected Management Frame". In that sense it is always better if you can move connection to WPA3. That will mitigate DoS - Denial of Service attacks to your Wi-Fi.

When it comes to WPA3-Enterprise, you can go for 192 bit mode for highly sensitive environment to achieve highest security strength. Typical environment you can go with 128-bit AES with CCMP. AKM value 5 as oppose to AKM 12 (see below image).

HTH
Rasika
*** Pls rate all useful responses ***

[Rich R]

And you're suggesting that for a guest network @Rasika Nayanajith ?

If you did want to do that then might be worth looking into using OpenRoaming for your guests - just need to work out how to onboard them easily.

[Rasika Nayanajith]

Hi Rich,

Open guest networks, recommendation is to go with "Enhanced Open" also known as OWE - Opportunistic Wireless Encryption (AKM 18). Given current client all may not supporting it, you have to deploy it in transition mode. In "Enhanced Open" transition mode, you have to create 2 SSIDs, due to that many stay away from OWE transition mode deployment, but if you need on the fly encryption for your guest SSIDs that is the way to go.

Below two posts describe it in detailed
1. https://mrncciew.com/2019/11/21/enhanced-open-part-1/
2. https://mrncciew.com/2019/11/22/enhanced-open-part-2/

HTH
Rasika

[Rich R]

Yep that's exactly what we already explained Rasika - it was you who suggested AKM 5 (802.1X with SHA-256)

[Rasika Nayanajith]

Not sure if I missed reading it, but I didn't see that the post was referring to the Guest Wi-Fi network. I understood it as WPA2-Enterprise vs. WPA3-Enterprise discussion and in that context going ahead with AKM5 (WPA3-Enterprise) is recommended.

HTH
Rasika

[cagdasd]

Hi Rasika,

Read the thread like a poem. I came here while I was looking up for a CISCO device which supports WPA3 Enterprise but with only CCMP-128 (AES) framework. Most of the new devices support GCMP suites but my client firmware is not complieant with that. Does these GCMP/CCMP security frameworks backward compatible ? Which device/AP to chose to get CCMP-128 support ?

Thanks.