Safer and faster WPA3 logins prevent denial of service attacks
Fast and Secure Simultaneous Authentication of Equals for WPA3
Cryptography and SecurityNetworking and Internet Architecture
Summary
The WPA3 security system protects Wi-Fi passwords from hackers with a method called SAE, but it requires a lot of computing power, which can slow down or crash network devices like routers during login attempts. The authors designed changes that shift the hard work away from the router to the connecting device, so the router doesn't get overwhelmed. They also add tricks to slow down attackers guessing passwords and speed up reconnecting trusted devices. Their tests show these changes keep networks safer without making it harder for real users to connect.
What this means in practice
- •For network engineers: Reduce denial-of-service attacks on wireless access points by moving costly password computations to connecting clients.
- •For security architects: Design WPA3-based systems that make brute-force password attacks slower and re-authentication with known devices faster and safer.
Authors
João Ferreira, André Zúquete, Hélder Gomes
Abstract
The Simultaneous Authentication of Equals (SAE) protocol, introduced in WPA3, provides robust protection against offline dictionary attacks against a network Pre-Shared Key (PSK) and also protection of session keys from other people knowing that PSK. However, its high computational cost for the Password Element (PE) derivation makes Access Points (APs) vulnerable to CPU exhaustion Denial-of-Service (DoS) attacks. This paper proposes a resilient architectural modification to SAE. First, we introduce an asymmetric resource cost model that offloads the iterative discovery of cryptographic elements to the client, allowing the AP to maintain a fixed computational load during the handshake. To further mitigate brute-force attempts, we implement a mechanism based on a slow-path key derivation (with variable cost key derivation functions, such as PBKDF2 or Argon2), incorporating a deliberate processing delay on the supplicant. Finally, we introduce a ticket-based mechanism to facilitate efficient re-authentication for known devices, bypassing expensive exchanges while preserving system availability under adversarial conditions. Experimental results demonstrate that this architecture significantly mitigates DoS risks without compromising legitimate network access.