Wifi - Authentication Modes

Yes, HMAC-SHA-384 is used in WPA3-Enterprise (192-bit security mode) for authentication and key derivation. Let me break down the authentication mechanisms used across all Wi-Fi security protocols:

WPA3 Authentication Methods

WPA3-Personal

HMAC-SHA-256: Used in SAE (Dragonfly) protocol for key derivation
AES-CCMP-128: Data integrity using CBC-MAC (not HMAC per se, but authentication)

WPA3-Enterprise (192-bit mode)

HMAC-SHA-384: Key derivation functions and authentication
AES-GCMP-256: Galois Counter Mode with authentication
ECDSA: Digital signatures with P-384 curves

WPA2 Authentication Methods

Message Authentication

HMAC-SHA-1: Primary HMAC algorithm for key derivation
HMAC-MD5: Used in some implementations
AES-CCMP CBC-MAC: Data frame integrity (128-bit)

Key Derivation Functions

PTK = HMAC-SHA-1(PMK, "Pairwise key expansion" || data)
GTK = HMAC-SHA-1(GMK, "Group key expansion" || data)

EAP Methods (Enterprise)

HMAC-MD5: EAP-MD5 (rarely used)
HMAC-SHA-1: Most EAP methods
TLS-based: Certificate authentication in EAP-TLS/PEAP

WPA (Original) Authentication Methods

TKIP Authentication

HMAC-MD5: Key derivation and mixing functions
Michael MIC: Custom authentication algorithm (not HMAC)
RC4: No built-in authentication (relies on Michael MIC)

Michael Algorithm Details

Michael MIC = michael(MIC_key, DA || SA || Priority || MSDU)

Not HMAC-based, custom 64-bit authentication
Uses simple operations for hardware compatibility
Weaker than cryptographic HMAC functions

WEP Authentication Methods

Shared Key Authentication

CRC-32: Integrity Check Value (not cryptographically secure)
No HMAC: WEP predates widespread HMAC adoption
Challenge-Response: Simple challenge-response (easily defeated)

WEP "Authentication" Process

1. Client requests authentication
2. AP sends 128-byte challenge text
3. Client encrypts challenge with WEP key
4. AP decrypts and compares with original

Critical Weakness: CRC-32 is linear and easily forged, providing no real authentication.

Comparison of Authentication Strengths

Protocol	Primary Auth Method	Key Derivation	Security Level
WEP	CRC-32 (broken)	None	Broken
WPA	Michael MIC	HMAC-MD5	Weak
WPA2	CBC-MAC/HMAC-SHA-1	HMAC-SHA-1	Strong
WPA3-Personal	CBC-MAC/HMAC-SHA-256	HMAC-SHA-256	Very Strong
WPA3-Enterprise	GCMP/HMAC-SHA-384	HMAC-SHA-384	Highest

HMAC Evolution in Wi-Fi Security

MD5 Era (Early 2000s)

WPA used HMAC-MD5 for key derivation
MD5 considered secure at the time
Later discovered to have collision vulnerabilities

SHA-1 Era (Mid 2000s)

WPA2 adopted HMAC-SHA-1 as standard
Better security properties than MD5
Still widely used, though SHA-1 now deprecated in many contexts

SHA-2 Era (2010s+)

WPA3 uses HMAC-SHA-256 for personal networks
HMAC-SHA-384 for enterprise 192-bit security
Future-proofing against cryptanalytic advances

Specific HMAC Usage Examples

WPA2 Key Derivation

PMK = PBKDF2(passphrase, ssid, 4096, 256)
PTK = HMAC-SHA-1(PMK, "Pairwise key expansion" || 
                  Min(AA,SPA) || Max(AA,SPA) || 
                  Min(ANonce,SNonce) || Max(ANonce,SNonce))

WPA3 SAE Authentication

KCK || KEK = HMAC-SHA-256(K, "SAE KCK and KEK")
confirm = HMAC-SHA-256(KCK, send-confirm || scalar || element)

WPA3-Enterprise Key Derivation

PMK = HMAC-SHA-384(MSK, "PMK expansion" || context)

Authentication Beyond HMAC

Certificate-Based Authentication

EAP-TLS: Uses digital signatures (RSA, ECDSA)
X.509 certificates: PKI-based authentication
Not HMAC-based: Uses asymmetric cryptography

Hardware-Based Authentication

TPM: Trusted Platform Module authentication
Smart cards: Certificate-based authentication
Biometrics: Fingerprint, facial recognition (supplementary)

Modern Trends

Quantum Resistance Considerations

SHA-384 provides better quantum resistance than SHA-256
WPA3-Enterprise 192-bit mode designed with post-quantum cryptography in mind
Future protocols may adopt post-quantum authentication methods

Performance Optimization

Hardware acceleration for AES and SHA functions
Dedicated cryptographic processors
Balance between security and computational efficiency

The evolution from WEP's broken CRC-32 to WPA3's HMAC-SHA-384 represents a dramatic improvement in authentication strength, reflecting advances in cryptographic understanding and the need for future-proof security protocols.