Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I was editing the configuration for my Time Capsule, when I noticed that I had the following options for network encryption:

enter image description here

Why is there an option of WPA/WPA2? Is it as secure as WPA2 Personal?

When looking for the network with other devices, I'm am told to enter a WPA2 Password. Thus, I thought that I had configured it using WPA2 Personal.

share|improve this question
    
This is not really a Apple-related. You might have more answer on Super User. I've flagged it, a moderator will decide if we should migrate it there or not. –  Loïc Wolff Dec 30 '11 at 10:41
    
Ok! No problem. –  gentmatt Dec 30 '11 at 10:52
    
This question is on topic for Ask Different - as long as general questions apply to Apple hardware or software they're allowed. That said, @Matt I'll move it if you want me to, but don't feel like it should be moved. –  Kyle Cronin Dec 30 '11 at 13:03
    
Let's leave it here then. –  gentmatt Dec 30 '11 at 13:07
    
WPA was an intermediate solution to the weak WEP security. It uses 128bit encryption (over the 40bit supplied by WEP). WPA2 is the full 802.11i standard. Above WPA, it also introduced a new AES-based encryption mode (making it even more secure). A small subset of cards (that came out during this transition period) only support WPA. The option is to support these legacy devices (circa 2003). Today, you shouldn't see anything that can't support WPA2. –  cksum Dec 30 '11 at 20:33

4 Answers 4

up vote 2 down vote accepted

I believe that WPA was the original WPA standard, and WPA2 was an improved version of it. Some network cards can’t connect to WPA2 networks. From the Wikipedia page on WPA:

The later WPA2 certification mark indicates compliance with the full IEEE 802.11i standard. This advanced protocol will not work with some older network cards.

The Wikipedia article cites a white paper from the Wi-Fi Alliance:

WPA is both forward and backward-compatible and is designed to run on existing Wi-Fi devices as a software download.

In a nutshell, a WPA/WPA2 network will any network card that supports WPA or WPA2 to connect to it; whereas a WPA2 only network locks out network cards that only support the newer standard. I don’t think there’s any meaningful difference in the security.

FWIW, I’ve used WPA2 Personal on my Airport Extreme since I bought it, and no device has ever had problems connecting.


Confession: I initially misread the question as being about the difference between Personal and Enterprise, and wrote this. Although not directly answering the question, I include it for interest.

“Personal” and “Enterprise” just refer to the two flavours of WPA and WPA2. From the Wi-fi Alliance’s page on WPA2:

WPA2 can be enabled in two versions - WPA2 Personal and WPA2 Enterprise. WPA2 - Personal protects unauthorized network access by utilizing a set-up password. WPA2 - Enterprise verifies network users through a server. WPA2 is backward compatible with WPA.

I believe that WPA and WPA2 both come in these two flavours, hence the either/or. Personal is more suitable for a home network, but it’s less secure than enterprise. Enterprise connects to a “RADIUS server” for authentication. I don’t know what that is, but it sounds clever and secure.

I’d guess that a device connecting to your Time Capsule just sees a request for a WPA2 password, hence why it doesn’t ask you for a WPA2 Personal password.

share|improve this answer

Both 'WPA' and 'WPA2' use AES to encrypt the information transiting the WiFi network, but

WPA uses something called TKIP to manage the keys used to encrypt the data. TKIP is vulnerable to attack (it's not secure) and should not be used.

WPA2 uses AES-CCMP for key management.

"WPA/WPA2 Personal", also called mixed-mode, allows negotiation of key management modes and reduces the security of the network to the lowest common denominator.


BOTTOM LINE: If you're concerned about security/privacy of information on your networks (wired and wireless) , DON'T use WPA or WPA/WPA2. Use WPA2 only. And, if you don't already know, WEP is basically the same as having no security at all.


Another poster points out that the 'Enterprise' modes send authentication requests to a server before allowing a client on the network. The two big advantages are:

  • central management: I don't have to set keys on every access point, and I can disable accounts of individual users. There's also traceability: I know which WiFi device belongs to which user.
  • much longer keys (like 2048 bit, versus 128 for 'personal'). This further decreases the likelihood that an attacker can figure out the key in the time it's in use.

The 'personal' pre-shared key ("PSK") is derived from the passphrase you type into your client, so even if PSK allowed long keys, you'd have to type a passphrase that most people would object to.

share|improve this answer
    
Actually, WPA2 still does support a TKIP mode for keying; AES was just added. WPA2 also fixed some other issues in WPA. You are definitely right to say that WPA should not be used, but I'd add that AES should also be configured instead of TKIP. –  zigg Apr 4 '13 at 15:41

In general WPA2 personal is more secure that just WPA.

WPA/WPA2 Personal i believe to be either/or. It will use what it can. Normally being WPA2 Personal but the option below is a way to force a better security.

share|improve this answer

I have a TimeCapsule also and had to use the WPA/WPA2 Personal mode to allow an older Brother wireless printer to connect. Had the printer been capable of the newer WPA2 security protocol I would have used the WPA2 Personal setting in my TimeCapsule. Basically using WPA2 Personal is a tiny bit more secure, but restricts your wireless connections to newer devices.

share|improve this answer
    
But what exactly is the difference between WPA/WPA2 and WPA2? Or differently: which aspect of WPA/WPA2 reduces security compared to WPA2? –  patrix Jan 5 '13 at 14:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.