Why is shared key authentication considered a security risk in a WLAN?

Why is shared key authentication considered a security risk in a WLAN?

• A. The challenge is transmitted in the clear, but is not used.
• B. The access point transmits the challenge text in the clear and the same text is encrypted with the WEP key.
• C. WEP provides strong encryption for the shared key.
• D. Credentials are never exchanged during authentication.

Answer: (B)

Shared key authentication is risky because the server sends a random challenge in plaintext, and the client replies by encrypting that challenge with the WEP key. An eavesdropper can capture both the plaintext challenge and the encrypted response. With WEP’s weak encryption, this known-plaintext data makes it feasible to recover the WEP key offline. Once the key is known, the attacker can decrypt traffic, impersonate devices, and access the network. That’s why this method is considered insecure in a WLAN.

Shared key authentication is risky because the server sends a random challenge in plaintext, and the client replies by encrypting that challenge with the WEP key. An eavesdropper can capture both the plaintext challenge and the encrypted response. With WEP’s weak encryption, this known-plaintext data makes it feasible to recover the WEP key offline. Once the key is known, the attacker can decrypt traffic, impersonate devices, and access the network. That’s why this method is considered insecure in a WLAN.