WPA2-Personal is one shared passphrase | Rapid course Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 08. Map, example, EX054.

flowchart TD
  S["wifi_security = WPA2-Personal"] --> C{"String is WPA2-Personal or WPA3-Personal?"}
  C -->|Yes| P["PASS"]
  P --> L["Pass does not rewrite the string to WPA3"]
  L --> M["Personal mode is not a per-person account"]

The passing check accepts two strings. The dictionary holds one of them.

Logical drawing

dictionary: WPA2-Personal
check: WPA2-Personal or WPA3-Personal
result: PASS
not in the file: a passphrase, an authentication server, a per-person account

Learning outcomes

After this chapter, you should be able to:

Read the Wi-Fi predicate without upgrading the stored string.
Explain what Personal mode does and does not identify.
Keep the passphrase out of the note.

8.1 A passing mode check is a string comparison, not a roster of users.

The settings dictionary stores wifi_security as the literal WPA2-Personal. The predicate passes when that value is either WPA2-Personal or WPA3-Personal. Both would satisfy the line Wi-Fi uses WPA2 or WPA3. Only the first string is the evidence. A note that says the bakery "passed because it uses WPA3" replaces the dictionary. WPA3-Personal is a different mode. It is not what this file records, and the narrative in chapter 4 does not say the mode was changed. The pass stays a pass for the mode the dictionary names.

Personal mode, as opposed to an enterprise arrangement, means the wireless network uses a pre-shared passphrase. Anyone who is given that passphrase can associate. The network does not, in this design, ask each person for a distinct account at association time. NIST SP 800-153 treats the protection of a small wireless LAN as a configuration problem: know the mode, protect the shared secret, and keep networks that serve different populations apart. The publication does not convert a shared passphrase into per-person authentication. This book never prints the passphrase. Chapter 2 already fixes the handling rule: a new Wi-Fi password is given to Ellen in person or on paper, not in a message, and Leo does not keep it on a personal phone. Chapter 4 stores the new administrator passphrase in Ellen's password manager. Neither sentence is permission to type a secret into the lesson.

The guest-passphrase habit is narrower still. Ellen is asked to change the guest passphrase every few months and after staff leave. That habit is not a printed secret, and it is not a statement that the business SSID was rebuilt as an enterprise network with an authentication server. No such server appears in the device list.

8.2 Worked example

Lesson table; scroll horizontally to read all columns →

Note	Reading	Decision
"The dictionary says WPA2-Personal, and the mode check passes."	String and predicate	May stay
"WPA3 was not the stored value."	The other accepted string was not used	May stay
"The pass means each employee has a wireless account."	Personal mode	Refuse
"The passphrase is copied below."	No secret is in the file	Refuse

Synthetic case. No passphrase is created for this exercise.

Errors and limits

A modern-looking mode name can still be one secret shared by everyone who was told it.

Apply

EX054 — What did the mode check accept? The dictionary holds WPA2-Personal and the Wi-Fi line passes. Does that pass mean WPA3, a per-person account, or a passphrase you may copy?
Show marking criteria
Rubric: 3 = the stored string stays WPA2-Personal; the pass is the mode check; Personal mode is a shared passphrase; no per-person wireless account is recorded; no passphrase is copied;; 2 = the string stays and no secret is added;; 1 = the pass only;; 0 = none.