Enhancing Wi-Fi Security with DPPSK Support for WPA3

Zyxel_Lynn

Dynamic Personal Pre-Shared Key (DPPSK) for WPA3

Dynamic Personal Pre-Shared Key (DPPSK) is an authentication method where multiple users share the same SSID but utilize unique passwords. Nebula now extends this capability to WPA3, meeting the security requirements of modern standards like Wi-Fi 7.

The WPA3 Requirement: MAC Binding

In WPA2, the AP could validate multiple candidate keys sequentially during a four-way handshake. However, the WPA3 Simultaneous Authentication of Equals (SAE) handshake requires the AP to use the correct key immediately for complex calculations.

Consequently, MAC Address Binding is mandatory for DPPSK with WPA3. The AP uses the client's MAC address to retrieve the specific key from the NCAS or RADIUS server before starting the handshake.

Configuration Steps

1. SSID Setup: Select "Dynamic Personal Pre-Shared Key with WPA3" under security options.

     2. MAC Randomization: Users must disable MAC randomization on their personal devices to 
         ensure their hardware MAC is used for identification.
     3. Key Creation: In the Cloud Authentication menu, add DPPSK users and bind their device
         MAC addresses. Each key can bind up to 10 MAC addresses.

Organization Limits

Each organization can have a maximum of 2,048 DPPSK entries. This limit is calculated based on the total number of bound MAC addresses, not the number of keys. This feature requires a Pro Pack license to remain active.