What is WPA?
WPA was the Wi-Fi Alliance's stopgap after WEP (Wired Equivalent Privacy) was shown to be easy to crack. The full fix, IEEE 802.11i, was not finished yet, so WPA took part of the draft and packaged it so existing WEP hardware could be upgraded with a firmware or driver update instead of being replaced. WPA2, which implements the complete 802.11i standard with AES, followed in 2004.
How WPA improved on WEP
WPA uses TKIP (Temporal Key Integrity Protocol). TKIP keeps the RC4 cipher that WEP used, which is why older hardware could run it, but it fixes WEP's biggest flaws:
- Per-packet keys: TKIP mixes a new key for every frame, where WEP reused one static key with a short 24-bit initialization vector.
- Replay protection: a sequence counter rejects frames that arrive out of order.
- Integrity check: a message integrity code called Michael replaces WEP's weak CRC check.
Personal vs. Enterprise
| Mode | Authentication | Where it fits |
|---|---|---|
| WPA-Personal (WPA-PSK) | One pre-shared key: a passphrase of 8 to 63 characters shared by every user | Homes and SOHO networks |
| WPA-Enterprise | 802.1X with EAP; each user signs in with their own credentials, checked by a RADIUS server | Businesses and schools |
The same two modes carried forward into WPA2 and WPA3.
Comparing Wi-Fi security protocols
| Protocol | Encryption | Status |
|---|---|---|
| WEP | RC4 with static keys | Broken; never use |
| WPA | TKIP (RC4-based) | Deprecated; TKIP has known attacks |
| WPA2 | AES-CCMP | Acceptable with a strong passphrase |
| WPA3 | AES; Personal mode replaces the pre-shared key handshake with SAE | Current best choice |
Why WPA still matters to a technician
- Older routers may offer WPA with TKIP or a WPA/WPA2 mixed mode. Turn the WPA option off; devices that support only WPA should be replaced or kept off the main network.
- TKIP also slows the network: 802.11n and newer devices cannot use their high-throughput rates with TKIP and fall back to legacy rates of 54 Mbps or less.
- Router menus mix labels, such as WPA2-TKIP or WPA-AES. Judge the setting by the cipher: choose AES (CCMP), never TKIP.
- Any pre-shared key network, WPA or WPA2, is open to offline dictionary attacks against a captured handshake if the passphrase is weak. A long random passphrase or WPA3's SAE defeats this.
Troubleshooting cues
- An old printer, scanner or handheld device stops connecting after the router is switched to WPA2 or WPA3: it may support only WPA or WEP. Update its firmware, replace it, or put it on a separate isolated SSID.
- Clients fail to connect right after the security mode changes: they still hold the old profile. Forget the network and reconnect.
- A network in WPA/WPA2 mixed mode is slower than expected: switch to WPA2 (AES) only so no client falls back to TKIP.
WPA on the CompTIA A+ exam
WPA appears on the Core 1 acronym list, and wireless security protocols (WPA2, WPA3, TKIP and AES) are tested in Core 2. Know the order WEP, WPA, WPA2, WPA3, which cipher each uses, and that TKIP belongs to WPA while AES belongs to WPA2 and WPA3. If an answer pairs WPA or TKIP with "most secure," it is wrong. If a question asks which setting to choose on a SOHO router, pick WPA3, or WPA2 with AES when WPA3 is not available.