Does WPA2 use TKIP or not?

Question

I am writing my master's thesis about WLANs, and there is something what I don't really understand. This may be a dumb question but I didn't find a clear explanation.
WPA uses encryption TKIP. WPA2 uses encryption AES. So far so good. What I don't understand is, that during my research I found a lot of articles describing a mode WPA2-AES/TKIP or sometimes called mixed mode.

Does this mean that WPA2 can also operate using TKIP as well, or does this mean that WPA2 is downgraded to WPA, and then WPA uses TKIP?

Thanks in advance!

Answer 1

The WPA2-PSK can use both TKIP and (AES based) CCMP, but WPA2-Enterprise use only CCMP. The TKIP/AES refers to a configuration that allows both. As TKIP with RC4 cipher is insecure (and disallowed by the Wi-Fi Alliance) you shouldn't be using it anymore.

The security modes are pretty clearly summarized e.g. in Chris Hoffman's article on Wi-Fi Security or Penny Hoelscher's blog post on wpa2-aes-tkip. However, if you have access to the IEEE 802.11i-2004 standard you should use that as an official reference in your thesis, instead of blog posts.

Answer 2

There is indeed a lot of unclear information out there. Your first idea was correct, to the best of my knowledge. While I can't seem to find an authoritative source right now, this DD-WRT wiki page explains it the way I understand it:

TKIP vs AES-based CCMP

Defines the algorithm used for message integrity and confidentiality.

WPA was designed to be used with TKIP (and WPA2 designed to use stronger AES-based).

However, some devices allow WPA (not WPA2) with AES (and WPA2 with TKIP).

AES is optional in WPA; in WPA2 both AES is mandatory, but TKIP is optional.

Note that TKIP is not directly comparable to AES; TKIP is an integrity check, AES is an encryption algorithm. In the context of wireless security this actually means TKIP vs "AES-based CCMP" (not just AES).

TKIP is a lower end encryption protocol (WEP2) and AES is a higher end (WPA2/802.11i) encryption protocol. AES is preferred.

TKIP+AES

This is what the encryption standards are for WEP2 (TKIP) and WPA2/802.11i (AES). It will attempt to use AES if available and fall back to TKIP if not. This setting offers the most compatability but won't guarentee a higher level of encryption if a device falls back to TKIP.

It gets even more confusing; my access point running OpenWRT supports the following modes, among others:

• WPA with CCMP, TKIP, or both
• WPA2 with CCMP, TKIP, or both
• Mixed WPA/WPA2 with CCMP, TKIP, or both

Nowadays, the only relevant option is WPA2 with CCMP (or WPA3, of course).

Answer 3

Some historical perspective should help to shed some light on the confusion. The gist is that "backward compatibility" is the reason we still see TKIP around.

802.11-based WLANs originally came only with WEP, which was soon discovered to be too easily cracked to be sufficient for general usage in WLANs.

IEEE started working on 802.11i, an amendment to add a much more robust security framework to 802.11-based WLANs. However, in the meantime, the Wi-Fi Alliance introduced WPA with a stop-gap scheme, TKIP, as it was taking time for 802.11i to be published, and meanwhile, there were fears that the momentum of 802.11 could be broken due to poor security. (the exponential growth of 802.11 from 1999 onwards was part of the reason why the security issues suddenly became so urgent)

TKIP - temporary key integrity protocol - as part of WPA, addresses some of the main problems of WEP related to weaknesses in the use of keys. With TKIP, it was still using RC4 with relatively short keys, but at least, doing much improved key mixing to partially address the security concerns.

Backward compatibility was a major reason for the use of TKIP and other less computationally complex algorithms like MICHAEL in WPA. The issue was that the hardware in many of the WLAN devices in those days was deemed not powerful enough to perform AES encryption/decryption, but at least they could have WPA with TKIP.

Later on, 802.11i was published. WPA2 then appeared, basically incorporating the enhancements introduced in 802.11i. There are both the enterprise and the PSK modes, but definitely, WPA2-PSK with AES/CCMP is stronger than WPA2-PSK with TKIP.

For backward compatibility reasons (in case you're trying to connect a low end device that doesn't support AES), TKIP is still supported by some WiFi access points (typically, trying AES first and then falling back to TKIP; it could be called by various names like TKIP+AES). But generally, unless you really need to support that one or two old/low end devices in your network, it would be better to just go with WPA2 (PSK or enterprise) with AES/CCMP.