WPA2 vs WPA3: How the Key Is Agreed

WPA3-Personal replaced WPA2's password-derived key with a Diffie-Hellman exchange called SAE. See how Diffie-Hellman works with small numbers, how each version gets its key, and what that changes when a password leaks or someone tries to guess it.

Why the key exchange matters

Every Wi-Fi connection ends with the client and the AP holding the same secret key, which CCMP or GCMP then use to encrypt each frame. The question is how they arrive at that key. In WPA2-Personal it is calculated directly from the password and the network name, so it is the same every time and for everyone. In WPA3-Personal it comes out of a fresh Diffie-Hellman exchange (SAE, "Simultaneous Authentication of Equals") that only works if both sides know the password, and it is different for every connection.

1 · Diffie-Hellman with small numbers

Two sides agree on a shared secret while everything they send can be overheard. Step through the exchange and watch what the listener in the middle collects. Both use the public numbers p = 23 and g = 5. Each picks a private number and sends only g^private mod p. Real Wi-Fi uses elliptic curves with 256- to 521-bit numbers (usually 256); the idea is the same.

Client's private number AP's private number

View

2 · Where each version's key comes from

Step through both handshakes, then press Connect again a few times and watch the PMK (the master key both sides end up with). The WPA2 PMK is calculated in your browser with the real formula; the WPA3 one is shown as a random stand-in, because it depends on random numbers thrown away after each exchange. Nothing you type leaves your browser, but use a made-up password anyway.

Network name (SSID) Password (make one up)

WPA2-Personal (PSK)

WPA3-Personal (SAE)

3 · What if…

Pick a situation to see what each version protects.

4 · Other places Wi-Fi uses Diffie-Hellman

Open networks

Enhanced Open (OWE)

On a network with no password, the client and AP do a Diffie-Hellman exchange while associating, so each device gets its own encryption key. Passive listeners see nothing useful.

Nothing proves who the AP is, so it doesn't stop a fake AP with the same name. Required instead of plain open networks on 6 GHz.

802.1X / EAP

WPA2 and WPA3-Enterprise

EAP-TLS, PEAP and EAP-TTLS run a TLS handshake between the client and the RADIUS server. With ECDHE cipher suites (always, in TLS 1.3) the key the AP receives has forward secrecy, and every user gets their own keys.

WPA3-Enterprise 192-bit mode requires ECDHE on the P-384 curve (or 3072-bit DHE), with GCMP-256.

Onboarding

Wi-Fi Easy Connect (DPP) and FILS

Easy Connect adds devices by scanning a QR code: it uses elliptic-curve Diffie-Hellman to authenticate the device and set up its credentials, with no shared password.

FILS (802.11ai, fast initial link setup) can add an optional Diffie-Hellman exchange for forward secrecy.

5 · Side by side

	WPA2-Personal	WPA3-Personal	Enhanced Open (OWE)	WPA2/WPA3-Enterprise
How the key is agreed	Calculated from password and SSID (PBKDF2), then the 4-way handshake	SAE: password-authenticated elliptic-curve Diffie-Hellman, then the 4-way handshake	Unauthenticated elliptic-curve Diffie-Hellman	TLS inside EAP, usually with (EC)DHE
Forward secrecy	No	Yes	Yes	Yes, with (EC)DHE
Offline password guessing	Possible	Not possible: one guess per live exchange	No password	Depends on the EAP method; none with certificates (EAP-TLS)
Separate keys per connection	Different session keys, but anyone with the password can work them out	Yes	Yes	Yes, per user
Proves the AP is genuine	Only that it knows the password	Only that it knows the password	No	Yes, with server certificate validation
Protected Management Frames	Optional	Required	Required	Required in WPA3
Where required	Not allowed on 6 GHz	6 GHz (with H2E); devices must support it for Wi-Fi CERTIFIED 6 and later	Open networks on 6 GHz	Organisations with user accounts

What to do

Use WPA3-Personal where every device supports it. WPA3 transition mode (WPA2 + WPA3 on one SSID) helps during migration, but only WPA3 clients get SAE's protection; WPA2 clients on the same network are still exposed.
Where WPA2-Personal remains, use a long, random passphrase (20+ characters) and change it when people leave: it is the only thing protecting recorded traffic.
Use 802.1X (Enterprise) for staff networks, so each user has their own credentials and access can be revoked per person. Validate the server certificate on clients.
Turn on Protected Management Frames (required for WPA3) and keep AP and client firmware updated: the 2019 "Dragonblood" research found side-channel and downgrade issues in early SAE implementations, fixed by updates and by the hash-to-element (H2E) method.
Replace open guest networks with OWE (Enhanced Open) where clients support it, often as a transition pair with the open SSID.

Notes

The 4-way handshake still runs after SAE, exactly as in WPA2: it turns the PMK into the session keys and installs them. What changes is where the PMK comes from. See the 802.11 Connection Walkthrough.
How SAE ties the exchange to the password: both sides turn the password (and, with H2E, the SSID) into a starting point on the elliptic curve, the "password element". The Diffie-Hellman exchange is built on that point, so only someone who knows the password can complete it, and each attempt tests just one password guess.
Groups: SAE group 19 (the P-256 curve) is mandatory; APs may also offer groups 20 and 21 (P-384 and P-521).
This model: section 1 uses tiny numbers so the arithmetic can be followed; with p = 23 there are only 22 possible private numbers, while real curves have about 2²⁵⁶. The WPA2 PMK in section 2 is computed exactly (PBKDF2-SHA1, 4096 rounds, 256 bits) and shown as its first 8 bytes; the WPA3 PMK is a random stand-in, since the real one depends on values discarded after each exchange.