TKIP vs AES (CCMP) vs GCMP

The three ways WPA, WPA2 and WPA3 encrypt Wi-Fi data. Encrypt your own message with each one, using the real algorithms, then play attacker: flip a bit and see which receiver notices, and why an old TKIP network can shut itself down.

What "TKIP" and "AES" mean in your router's settings

Once a device has joined and finished the 4-way handshake, every data frame is encrypted and integrity-checked with a temporal key (TK) shared by that device and the AP. How that is done depends on the cipher suite:

TKIP (WPA, 2003) was a stop-gap that could run on WEP-era hardware through a firmware update. It keeps WEP's RC4 cipher but adds a fresh key for every packet, a packet counter and the Michael integrity check. CCMP (WPA2, 2004) is a clean design built on AES; it is what routers call "AES". GCMP is also AES, in Galois/Counter Mode: faster in hardware at multi-gigabit rates, with a longer 128-bit integrity check. It's used by WPA3-Enterprise 192-bit mode and supported by Wi-Fi 7 devices.

1 · What a protected frame looks like

The same data frame protected by each cipher. Boxes aren't to scale; hover or tap one for details.

Sent in the clear Encrypted data Integrity check (MIC) ICV, a CRC-32 kept from WEP

The 8-byte security header of the frame built in section 2, byte by byte. It carries the packet number in the clear so the receiver can rebuild the per-packet key or nonce and reject replays.

2 · Encrypt a message, step by step

Everything below is computed in your browser with the real algorithms (AES through your browser's Web Crypto; RC4, TKIP key mixing and Michael written out in full). The keys are demo keys, not taken from any real network, and the addresses are made up.

Your message (up to 48 characters)

Cipher

3 · Tamper test: flip a bit

An attacker captures the frame from section 2, changes it, and sends it on to the receiver. The attacker doesn't know the keys. Each receiver below runs its real checks on the changed frame.

Change

Which letter Attacker also fixes up the TKIP ICV (CRC-32)

4 · The speed cost of TKIP

Since 802.11n (Wi-Fi 4), the high-throughput rates may only be used with CCMP or GCMP. A device that connects with TKIP (or WEP) is held to the old 802.11a/g rates, 54 Mbps at most. Pick a client:

5 · Side by side

	WEP	TKIP	CCMP ("AES")	GCMP
Introduced	1997, the original IEEE 802.11 (40-bit key); 104-bit keys soon after	2003, Wi-Fi Alliance WPA; in IEEE 802.11i (2004)	2004, IEEE 802.11i; Wi-Fi Alliance WPA2	2012, IEEE 802.11ad (GCMP-128); GCMP-256 in 802.11ac (2013)
Called in settings	WEP, "64-bit" or "128-bit" key, Open or Shared Key authentication	TKIP, WPA, "WPA/WPA2 mixed" or "TKIP+AES"	AES, WPA2, WPA3-Personal	GCMP-256, WPA3-Enterprise 192-bit; supported by Wi-Fi 7 devices
Cipher	RC4 stream cipher; each packet's key is a 24-bit IV (sent in the clear) plus the shared 40- or 104-bit key, sold as "64-bit" and "128-bit"	RC4 stream cipher (from WEP), 128-bit per-packet key	AES-128, counter mode	AES-128 or AES-256, counter mode
Integrity check	CRC-32 ICV only, 32 bits and no key: after changing the data, anyone can recompute it	Michael, 64 bits (weak: roughly 20 bits of real strength), plus WEP's CRC-32 ICV	AES CBC-MAC, 64 bits	GHASH (GMAC), 128 bits
What the check covers	Data only	Data plus destination, source and priority	Data plus most of the MAC header (addresses, frame type, QoS TID)	Same as CCMP
Keys per packet	The same shared key for every packet and every client; only the 24-bit IV changes, so IVs repeat after a few thousand packets on a busy network	New RC4 key for every packet (key mixing), to avoid WEP's weaknesses	One key; a unique nonce per packet from the packet number	Same as CCMP
Replay protection	None	48-bit TSC	48-bit PN	48-bit PN
Overhead per frame	8 bytes (4 IV + 4 ICV)	20 bytes (8 header + 8 MIC + 4 ICV)	16 bytes (8 header + 8 MIC)	24 bytes (8 header + 16 MIC)
Fastest data rate	54 Mbps (802.11a/b/g rates only)	54 Mbps (802.11a/g rates only)	All rates	All rates; easy to run in parallel in hardware
Known attacks	Fluhrer–Mantin–Shamir (2001), KoreK (2004) and PTW (2007): the key is recovered from tens of thousands of captured packets in about a minute; forged and replayed frames are accepted	Beck–Tews (2008) and later: decrypt short packets and inject a few frames; RC4 biases	None practical against the cipher	None practical against the cipher
Status	Obsolete: removed from IEEE 802.11 except as the base TKIP is built on (802.11-2024, 12.3.2.1); not allowed in WPA, WPA2 or WPA3	Deprecated in IEEE 802.11-2012 and marked obsolete in 802.11-2024 (12.2.1); not allowed in WPA3 or on 6 GHz	Mandatory in WPA2 and WPA3	Optional in WPA3; required for WPA3-Enterprise 192-bit

Timeline

Notes

Where the keys come from: the password (or 802.1X login) gives a PMK; the 4-way handshake mixes it with two random numbers and both MAC addresses into the PTK, which includes the TK used here (for TKIP, also two 8-byte Michael keys, one per direction). Broadcast and multicast frames use a separate group key (GTK). See the 802.11 Connection Walkthrough.
Mixed mode (WPA/WPA2, "TKIP+AES"): devices that choose CCMP get full speed for their own traffic, but the group key has to be TKIP so that WPA-only devices can read broadcasts. Some APs hold every device to 54 Mbps in this mode, some newer devices won't join it, and WPA3 can't be enabled. Use AES only.
Why TKIP is weaker: Michael had to be cheap enough for 2003 WEP hardware, so it can be forged with far less work than a real MIC; that's why TKIP needs countermeasures. Its per-packet ICV is the linear CRC-32, which the Beck–Tews attack uses to guess a packet's last bytes one at a time, waiting more than 60 s between the guesses that trigger MIC failures. Recovering the MIC and ICV of a short ARP packet takes about 12–15 minutes, after which the attacker can compute the Michael key for that direction and inject a few forged frames.
Nonce reuse: CCMP and GCMP are safe only while a packet number is never reused with the same key. The KRACK attacks (2017) tricked devices into reinstalling a key and resetting its packet number; software updates fixed this. For GCMP a reused nonce is worse than for CCMP: it can reveal the authentication key and allow forgeries.
Management frames: Protected Management Frames (802.11w, required in WPA3) use the same CCMP or GCMP for unicast action frames and BIP (an AES-CMAC or GMAC check) for broadcast ones such as deauthentication.
This model: one uplink QoS data frame (To DS, TID 0) with locally administered addresses; the MAC header is simplified and only the frame body, MIC and ICV are computed exactly. In real networks, receivers never hand up the decrypted data of a frame that fails its check; it is shown here to make the bit flip visible. The TKIP countermeasure clock moves 5 s per attempt.