## Chapter 8 — WPA2-Personal is one shared passphrase ### Lesson map Lesson 08. Map, example, EX054. ```mermaid flowchart TD S["wifi_security = WPA2-Personal"] --> C{"String is WPA2-Personal or WPA3-Personal?"} C -->|Yes| P["PASS"] P --> L["Pass does not rewrite the string to WPA3"] L --> M["Personal mode is not a per-person account"] ``` The passing check accepts two strings. The dictionary holds one of them. ### Logical drawing ```text dictionary: WPA2-Personal check: WPA2-Personal or WPA3-Personal result: PASS not in the file: a passphrase, an authentication server, a per-person account ``` ### Learning outcomes After this chapter, you should be able to: 1. Read the Wi-Fi predicate without upgrading the stored string. 2. Explain what Personal mode does and does not identify. 3. Keep the passphrase out of the note. ### 8.1 A passing mode check is a string comparison, not a roster of users. The settings dictionary stores `wifi_security` as the literal `WPA2-Personal`. The predicate passes when that value is either `WPA2-Personal` or `WPA3-Personal`. Both would satisfy the line `Wi-Fi uses WPA2 or WPA3`. Only the first string is the evidence. A note that says the bakery "passed because it uses WPA3" replaces the dictionary. WPA3-Personal is a different mode. It is not what this file records, and the narrative in chapter 4 does not say the mode was changed. The pass stays a pass for the mode the dictionary names. Personal mode, as opposed to an enterprise arrangement, means the wireless network uses a pre-shared passphrase. Anyone who is given that passphrase can associate. The network does not, in this design, ask each person for a distinct account at association time. NIST SP 800-153 treats the protection of a small wireless LAN as a configuration problem: know the mode, protect the shared secret, and keep networks that serve different populations apart. The publication does not convert a shared passphrase into per-person authentication. This book never prints the passphrase. Chapter 2 already fixes the handling rule: a new Wi-Fi password is given to Ellen in person or on paper, not in a message, and Leo does not keep it on a personal phone. Chapter 4 stores the new administrator passphrase in Ellen's password manager. Neither sentence is permission to type a secret into the lesson. The guest-passphrase habit is narrower still. Ellen is asked to change the guest passphrase every few months and after staff leave. That habit is not a printed secret, and it is not a statement that the business SSID was rebuilt as an enterprise network with an authentication server. No such server appears in the device list. ### 8.2 Worked example | Note | Reading | Decision | |---|---|---| | "The dictionary says WPA2-Personal, and the mode check passes." | String and predicate | May stay | | "WPA3 was not the stored value." | The other accepted string was not used | May stay | | "The pass means each employee has a wireless account." | Personal mode | Refuse | | "The passphrase is copied below." | No secret is in the file | Refuse | > **Synthetic case.** No passphrase is created for this exercise. ### Errors and limits A modern-looking mode name can still be one secret shared by everyone who was told it. ### Apply - **EX054 — What did the mode check accept?** The dictionary holds `WPA2-Personal` and the Wi-Fi line passes. Does that pass mean WPA3, a per-person account, or a passphrase you may copy? *Rubric:* 3 = the stored string stays WPA2-Personal; the pass is the mode check; Personal mode is a shared passphrase; no per-person wireless account is recorded; no passphrase is copied;; 2 = the string stays and no secret is added;; 1 = the pass only;; 0 = none. ### Continue studying — lesson 08 (chapter 08 of 20) [← Chapter 07](#ch-07) · [Course chapter index](../SUBJECTS.md) · [Chapter 09 →](#ch-09) Continue to the next authored lesson. ## Worked answers **EX054.** The stored string stays WPA2-Personal. The pass is the mode check, not a change to WPA3 and not a per-person account. No passphrase is copied.