WPA3 SAE vs WPA2-PSK — Recovery Comparison

How WPA2-PSK leaks information

WPA2-Personal uses a Pre-Shared Key derived from password+SSID via PBKDF2. During the 4-way handshake, both parties prove knowledge of the PMK. An eavesdropper who captures the handshake can verify candidate passwords offline: compute PMK = PBKDF2(password, SSID), derive the PTK, and compare the EAPOL-Key MIC — an HMAC over public fields (nonces, MAC addresses, RSNE). No decryption of the encrypted key data is required, and no interaction with the AP is needed.

This is what makes WPA2 vulnerable to offline dictionary and brute-force attacks once a handshake is captured. The cryptography is sound; the protocol design accidentally enables offline verification.

How WPA3 SAE prevents this

SAE is a Password-Authenticated Key Exchange (PAKE) protocol. Both parties derive a shared secret from the password using elliptic-curve operations (some configurations use finite-field/MODP groups instead; the side channel discussed below was group-dependent) that don't leak password material to passive observers.

Critically: a captured SAE handshake does not contain enough information to verify candidate passwords offline. Each verification attempt requires an active interaction with the AP — and the AP can rate-limit or refuse repeated attempts.

This shifts the attack from offline (unlimited compute, no rate limit) to online (network round-trip per attempt, AP can block). Online attacks against WPA3 are limited by network speed and AP cooperation, making brute force practically infeasible.

What recovery looks like for WPA3

If you forget your own WPA3 network password, captured-handshake recovery doesn't apply. Your options are: (1) reset router to factory defaults and reconfigure (printed default password on router label); (2) access router admin interface from a wired connection or a still-connected device; (3) check device-stored saved networks (Windows wifi profiles, macOS Keychain, iOS settings).

Recovery services that work against WPA2 typically can't help with pure WPA3 networks. On a WPA3-only network the protocol design removes the offline technique.

Mixed WPA2/WPA3 networks

Many consumer routers in 2026 still ship WPA2-Personal-only or WPA2/WPA3 mixed (transition) mode; WPA3-only remains rare. Clients that support WPA3 use SAE; older clients fall back to WPA2-PSK. The same password is shared across both modes.

A transition-mode AP advertises PSK alongside SAE, so a WPA2 handshake or PMKID can be obtained from it regardless of which clients are present, and that material is attacked offline with the same password. Mixed networks aren't fully WPA3-protected — they're as weak as the weakest enabled mode.

Transition mode is not the only exposure. An attacker can stand up a rogue AP broadcasting the same SSID as a WPA3-only network, and a client that falls back to WPA2 on it sends an authenticated 4-way message 2 that a dictionary attack can be run against. WPA3-only mode is therefore only as strong as its clients' downgrade behaviour.

WPA3 attack surface in 2026

Research on WPA3 has produced two different classes of result. The timing and cache side channels (CVE-2019-9494, CVE-2019-13377) were fixed in hostapd/wpa_supplicant and shipped by vendors. The transition-mode downgrade is not a firmware bug — it follows from a mixed AP advertising PSK alongside SAE, and no update removes it; only WPA3-only mode does. See Vanhoef & Ronen, 'Dragonblood', IEEE S&P 2020.

For owners: running WPA3-only mode removes the WPA2 path on the AP side, but it is only as strong as your clients' downgrade behaviour — a client that falls back to a rogue WPA2 AP broadcasting the same SSID can still produce a crackable WPA2 handshake. The defences are client-side: Transition Disable / trust-on-first-usage on your devices, or running separate WPA2 and WPA3 networks with different passwords.

Frequently Asked Questions

Related references