Is it possible to implement WPA encrypted wireless network without any predefined secrets like PSK?

For example: a coffee shop with WPA-PSK protected network. Everyone who has ever been in the coffee shop knows the passphrase for their network, so they can also capture all the handshakes and use them to decrypt all the traffic, right?

So could we just remove the redundant PSK? So that handshakes would still be the weak point but all the rest of traffic would still be encrypted?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14 '17 at 22:17

Use WPA(2) Enterprise. This means you will have to install an authentication server using the RADIUS protocol, for example FreeRADIUS. But each user will then have its own password (or other means of authentication if you want). See also this post for more information.

  • I'm well aware of WPA-802.1X aka WPA Enterprise, but my question is really all about establishing encrypted sessions without any static passwords or secrets (like certificates).
    – Akseli
    Jul 24 '16 at 22:11

There are various ways you can have encryption without using a single widely-known PSK, but you'll need some sort of extra step by the users to actually make use of it by getting some form of credentials. I have seen at least two ways to do this :

  • Provide a username / password (managed in some sort of directory / guest infrastructure such as FreeRadius or Cisco ISE) that you then use with MSCHAPv2 for example. You either pre-generate them and pass them out, or provide a self-sponsorship portal through which they can obtain them autonomously. The main problem is that the necessary settings can be tricky to find and make sense of. IOS makes it easy, Android is already noticeably worse and Windows is not fun at all.
  • Use a proprietary approach such as Aerohive's Private PSK (each user gets their own unique PSK). This is simpler for users as they enter it in their device like they would a PSK at home, however it does tie you to a single vendor, and you still need the user to go through a portal, and possibly provide some rather obscure information (e.g. MAC address).

On the other hand, I think it's less and less clear that wifi-level encryption on a public/guest network is all that useful since most apps that really need the encryption already provide it at their own level, typically through HTTPS. The era of unencrypted passwords passing over raw POP3 or HTTP for example is (thankfully) nearly past us I think.

  • Thank you for your input. So basically it's just like I thought: there's no way to implement what I described in my question. Every given way requires some kind of pre-shared secret.
    – Akseli
    Jul 24 '16 at 23:35
  • @jouhisorsa I believe Hotspot 2.0 would allow supported devices to negotiate their own EAP secret without too much complexity for the user. Aug 14 '16 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.