 Advanced Encryption Standard (Section "IEEE 802.11i and WPA2, p. 219"). Wi-Fi Protected Access - WPA To overcome these known vulnerabilities in the original 802.11 security implementation, the Wi-Fi Alliance developed Wi-Fi Protected Access (WPA) as a means to provide enhanced protection from targeted attacks. WPA was an interim measure that was based on a subset of the enhanced security mechanisms that were then still under development by 802.11 TGi as part of the 802.11i standard. WPA uses the temporal key integrity protocol (TKIP) for key management, and offers a choice of either the 802. 1x authentication framework together with extensible authentication protocol (EAP) for enterprise WLAN security (Enterprise mode), or simpler pre-shared key (PSK) authentication for the home or small office network which does not have an authentication server (Personal mode). These measures, which were initially available as firmware upgrades to Wi-Fi compliant devices, first came to market in early 2003. In 2004, a further strengthening of the encryption was introduced in the second generation WPA2. This replaced RC4, still used in WPA, with the advanced encryption standard (AES) which was ratified as part of the 802.11i standard in June 2004. The key components of WPA and WPA2 are described in the following sections. Temporal Key Integrity Protocol The WEP encryption vulnerability was addressed in WPA by two new MAC layer features: a key creation and management protocol called TKIP (temporal key integrity protocol) and a message integrity check function (MIC). Features of WEP and WPA key management are compared in Table 8-2. Wireless LAN Security Table 8-2: WEP and WPA Key Management and Encryption Compared Security feature Temporal key/Passphrase 40-bit, 104-bit 128-bit Initialisation vector (IV) 24-bit 48-bit Static Dynamic Encryption cipher After a station has been authenticated, a 128-bit temporal key is created for that session, either by an authentication server or derived from a manual input. TKIP is used to distrib