WiFi Communication

Versions

The original base version of the IEEE 802.11 standard was released in 1997, but is now obsolete and replaced with subsequent amendments. The amendments defined in the table below are ones that are commonly found with WiFi modules, microcontrollers, and SBCSingle Board Computers, but more amendments can be found at Wikipedia.

Architecture

These basic components of the 802.11 architecture are defined below. Many WiFi modules, such as the ESP-01, can be configured to operate in either AP, STA, or AP+STA modes.

Node:

A node is a device, such as a computer, printer, smartphone, or router that is hooked up to a network and is capable of sending or receiving data. Nodes can be adjacent to one another where they communication directly with each other or there may be an intermediate node, such as a switch or router, between two nodes that data must pass through.

Link:

Links are connections between nodes on a network. Links can be point-to-point where two nodes communicate with each other or multipoint where a node communicates with two or more nodes.

Basic Service Set (BSS):

The fundamental building block of the 802.11 architecture is called a Basic Service Set (BSS) that contains one or more wireless stations (STA) connected to a base station Access Point (AP).

Station (STA):

A Station (STA) is a device that has the capability to connect to an existing WiFi network as a client, such as smartphones or computers that join an established network and communicate with other devices on that network or access the internet.

Access Point (AP):

An Access Point (AP) is a device that creates a Wireless Local Area Network (WLAN) and acts as a central hub that allows other devices, such as smartphones or computers, to connect to it over Wi-Fi.

AP+STA:

A Wi-Fi device in AP+STA mode acts as both an Access Point (AP) as well as a Station (STA), where the device can connect to an existing network as a client (STA) while simultaneously hosting its own network (AP) for other devices to connect to.

Identifiers

Identifiers are used as a label that allows devices and networks to be identified. Identifiers are used as a label that allows devices and networks to be identified. Three common identifiers (MAC, BSSID, and SSID) that are used in WiFi networks are defined below.

Media Access Control (MAC) Address:

The MAC address, sometimes referred to as a hardware or physical address, is a unique 48-bit 12-character alphanumeric label used to identify every device on a network (every member of a Basic Service Set), whether an access point or end station. The MAC address is factory set for each participating device.

Basic Service Set Identifiers (BSSID)::

The BSSID is the MAC physical address of the access point or wireless router used to connect to the WiFi. It is a unique 48-bit hexadecimal number label associated with an individual access point and set of clients affiliated with a specific service set.

Service Set Identifier (SSID):

The SSID is a unique name assigned to a WiFi network. It is composed of letters, numbers, and symbols, and can be as long as 32 characters, according to the 802.11 Wireless Local Area Networks (WLAN) standard.

Channels

The IEEE 802.11 standard provides several distinct radio frequency band ranges for WiFi: 860/900MHz, 2.4GHz, 3.6GHz, 4.9GHz, 5GHz, 5.9GHz, 6GHz, 45GHz, and 60GHz. Each range is divided into a multitude of channels numbered at 5MHz spacing within a band (except in the 45/60GHz band, where they are 0.54/1.08/2.16GHz apart), and the number linearly relates to the center frequency of the channel. However, in practice, transmitters generally occupy at least 20MHz, and standards allow for channels to be bonded together to form wider channels for faster throughput. The channels for each frequency range are listed at Wikipedia.

Duplex

WiFi communication is half-duplex where each device can either transmit or receive, but not at the same time. Full-duplex on the same channel would have an issue with collisions or it would require the use two separate RFRadio Frequency channels. The 802.11 protocol is a time division duplex where WiFi devices that act as clients and Access Points (APs) are either in transmit mode or in receive mode. When a WiFi device has some data to transmit, it first checks to see that no other device is transmitting before it transmits data.

WiFi Security

WiFi security protocols protect against unauthorized access and eavesdropping on wireless networks by encrypting data on the radio signals that pass between your device and the Access Point (APA WiFi Access Point (AP) is a device that creates a wireless local area network, or WLAN, and acts as a central hub that allows other devices, such as smartphones or computers, to connect to it over WiFi.) such as a router. There are four main network security protocols: WEP, WPA, WPA2, and WPA3.

WEP

Wired Equivalent Privacy (WEPWired Equivalent Privacy (WEP) is an encryption security protocol for 802.11 wireless networks to protect the information you send and receive over a wireless network. WEP was ratified as a Wi-Fi security standard in September of 1999.) was the first security protocol introduced in 1997 to protect wireless data by encrypting it using a 64-bit or 128-bit keys in hexadecimal. WEP uses static keys where one key is used for all packets for all devices on a network. WEP uses the stream cipher RC4 for confidentiality and the CRC-32 checksum for integrity. Due to the vulnerabilities of WEP, the WiFi Alliance officially retired it in 2004 and it is now considered obsolete although still sometimes in use by older devices that cannot support newer encryption methods like WPA.

WPA

WiFi Protected Access (WPAWi-Fi Protected Access (WPA) is an encryption security protocol for 802.11 wireless networks to protect the information you send and receive over a wireless network. WPA was released in 2003 as a replacement to the increasingly apparent vulnerabilities of the WEP standard.) was introduced in 2003 as a replacement of WEP. WPA uses a 128-bit dynamic key called Temporary Key Integrity Protocol (TKIPTemporal Key Integrity Protocol (TKIP) is a security protocol used in the IEEE 802.11 wireless networking standard. It was designed as an interim solution to replace WEP without requiring the replacement of legacy hardware. TKIP employs a per-packet key system that was more secure than the fixed key system used by WEP. However, TKIP itself is no longer considered secure and was deprecated in the 2012 revision of the 802.11 standard. It was superseded by Advanced Encryption Standard (AES).), which dynamically changes the key for each packet transmitted over the network, making it unique and hard to break. WPA also replaced the CRC-32 checksum with a Message Integrity Check to better determine if an attacker had captured or altered data packets.

WPA2

WiFi Protected Access 2 (WPA2Wi-Fi Protected Access 2 (WPA2) is an encryption security protocol for 802.11 wireless networks to protect the information you send and receive over a wireless network. WPA2 was released in 2004 as a replacement of WPA.) was introduced in 2004 as an upgrade to WPA and is one of the most used security encryption types. The Temporary Key Integrity Protocol (TKIPTemporal Key Integrity Protocol (TKIP) is a security protocol used in the IEEE 802.11 wireless networking standard. It was designed as an interim solution to replace WEP without requiring the replacement of legacy hardware. TKIP employs a per-packet key system that was more secure than the fixed key system used by WEP. However, TKIP itself is no longer considered secure and was deprecated in the 2012 revision of the 802.11 standard. It was superseded by Advanced Encryption Standard (AES).) was replaced by the stronger and more reliable Counter Mode Cipher Block Chaining Message (CCMPCounter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP)). The CCMP protocol is based on the Advanced Encryption Standard (AESAdvanced Encryption Standard (AES) is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology (NIST) in 2001. It was developed an alternative to the Data Encryption Standard (DES), which was starting to become vulnerable to brute-force attacks.) algorithm with a 128-bit key, which provides message authenticity and integrity verification.

WPA2-Personal and WPA2-Enterprise are two different versions of WPA2 that both use AES-CCMP encryption, but differ in their authentication stage. WPA2-Personal (WPA2-PSK) was designed primarily for home use and is secured with a Pre-Shared Key that all devices use to access the network (access requires SSIDService Set Identifier (SSID) is a unique sequence of characters that uniquely names a Wi-Fi network. A SSID is sometimes referred to as a network name. and password). WPA2-Enterprise (WPA2-EAP) is more suited for organizational or businesses that gives every user their own private session key (access requires SSIDService Set Identifier (SSID) is a unique sequence of characters that uniquely names a Wi-Fi network. A SSID is sometimes referred to as a network name., username, and password).

WPA2 is vulnerable to Key Reinstalltion AttaCKs (KRACK), which allows attackers within the proximity of the network to pose as a clone network and force the victim to connect to a malicious network instead, allowing the hacker to decrypt a small piece of data that may be aggregated to crack the encryption key.

WPA3

WiFi Protected Access 3 (WPA3Wi-Fi Protected Access 3 (WPA3) is an encryption security protocol for 802.11 wireless networks to protect the information you send and receive over a wireless network. WPA3 was released in 2018 as a replacement of WPA2.) was introduced in 2018 as a replacement of WPA2. It is the most secure option that is gaining popularity, but is still not supported by many devices. It uses an equivalent 192-bit cryptographic strength in WPA3-Enterprise mode (AES-256AES-256 is a variant of the Advanced Encryption Standard (AES) block cipher, specified with a key size of 256 bits, a fixed block size of 128 bits, and 14 transformation rounds that convert the input (plaintext) into the final output (ciphertext). in GCM mode with SHA-384 as HMAC) and CCMP-128 (AES-128AES-128 is a variant of the Advanced Encryption Standard (AES) block cipher, specified with a key size of 128 bits, a fixed block size of 128 bits, and 10 transformation rounds that convert the input (plaintext) into the final output (ciphertext). in CCM mode) as the minimum encryption algorithm in WPA3-Personal mode.

The WPA3 standard replaces the pre-shared key (PSK) exchange with Simultaneous Authentication of Equals (SAE) exchange, a method originally introduced with IEEE 802.11s, resulting in a more secure initial key exchange in personal mode and forward secrecy (protects data traffic even if a password is compromised after the data was transmitted).

WPA offers a transition mode for backwards compatibility that enables the use of WPA2 for devices without WPA3 support.

HTTPS & TLS

The WEP/WPA/WPA2/WPA3 WiFi security protocols provide network protection against unauthorized access and eavesdropping on the radio signals that pass between your device and the Access Point (AP) such as a router. However, they do not provide protection from someone else on the same network and any communication that goes outside the local network to the internet such as websites.

Securing individual connections made to specific destinations, such as between client and server, are commonly done using the HTTPSHypertext Transfer Protocol Secure protocol with TLSTransport Layer Security encryption. HTTPS uses port 443 by default to differentiate it from HTTP, which uses port 80. HTTPS is a secure version of the HTTP protocol that adds privacy, integrity, and authentication.

Privacy:

The data that passes back and forth between client and server is encrypted to protect against eavesdropping.

Integrity:

Ensures the data that passes back and forth between client and server is not corrupted or tampered with by man-in-the-middle attacks.

Authentication:

The identity of the server is vouched for with an SSLSecure Sockets Layer Certificate issued from a Certificate Authority (CA) to ensure the website is not a fake one ran by criminals trying to collect credit card or password information.