Abstract
WPA3 is the new standard for wireless security, which was supposed to fix flaws in older standards like WPA2. Even though it has stronger mechanisms for authentication and encryption—Simultaneous Authentication of Equals (SAE), secure connection setup—research has shown multiple possible vectors of attack. This paper presents a comprehensive analysis of vulnerabilities in WPA3 and methods of attack, including dictionary attacks during the handshake of SAE, downgrade attacks, Evil Twin access point spoofing, and problems relating to Protected Management Frames (PMF). The tests were actually carried out in a controlled laboratory environment with the help of special tools and hardware. Results indicate that under certain conditions both confidentiality and availability can be attacked notwithstanding the protocol’s formal security. The paper ends with recommendations on how user, administrator, and device manufacturer security practices should be improved.