TKIP vs AES (CCMP) vs GCMP

See how TKIP, AES (CCMP) and GCMP protect Wi-Fi frames: encrypt a message step by step with the real algorithms, tamper with it, and compare speed and security.

How to use this tool controls and what to look for

Encrypt your own message step by step with each cipher, then tamper with the frame and see which check catches it.

Controls to change

  • Cipher: compare TKIP (WPA), CCMP = AES (WPA2/3) and GCMP-256 (WPA3).
  • Your message (up to 48 characters): type a message to encrypt.
  • Next step: go through the encryption one step at a time, or use Show all steps.
  • Send it again (next packet number): see how the ciphertext changes with each packet.
  • What to change: in the tamper test, change a letter of the message or the destination address, then Send tampered frame.
  • Replay the original frame: send an old frame again and see the replay check reject it.

What to look for

  • The same message encrypts differently every time, because the packet number changes.
  • A flipped bit passes TKIP's CRC-32 if the attacker fixes it up, but the Michael MIC or the AES MIC catches it.
  • After two Michael MIC failures, TKIP shuts down for 60 seconds.
  • TKIP limits a device to 54 Mbps, which is one more reason it's deprecated.

Open full screen ↗

About this tool

Wi-Fi protects each data frame with the cipher suite chosen when the device connects. TKIP (WPA, 2003) kept WEP's RC4 cipher so old hardware could be upgraded. CCMP, shown as "AES" in most routers, is the AES-based suite of WPA2 and WPA3. GCMP is the newer AES-GCM suite used by WPA3-Enterprise 192-bit and supported by Wi-Fi 7 devices. This tool encrypts your own message with each one, step by step, using the real algorithms, then lets you tamper with the result.

What you'll learn

  • What the TKIP, CCMP and GCMP headers, MIC and ICV look like in a protected frame
  • How TKIP's per-packet RC4 keys and Michael check differ from AES with CBC-MAC or GHASH
  • Why a changed bit is caught, and why TKIP shuts down for 60 seconds after two MIC failures
  • Why TKIP limits a device to 54 Mbps, and why it's deprecated

Common questions

What does "AES" mean in router security settings?
It means CCMP, the AES-based encryption of WPA2 and WPA3. "TKIP+AES" is mixed mode, which keeps TKIP for older devices.

Is TKIP still safe?
No. It has been deprecated since 2012, has known attacks, isn't allowed with WPA3 or on 6 GHz, and limits devices to 54 Mbps. Use AES (CCMP) only.

What's the difference between CCMP and GCMP?
Both use AES. GCMP uses Galois/Counter Mode, which is faster in hardware at high data rates, with a 16-byte integrity check instead of 8.

Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.