edVirtus Reference

What Is Simultaneous Authentication of Equals?

How Does SAE Improve the Security of Wi-Fi Networks?

Simultaneous Authentication of Equals (SAE) is a secure password-authentication protocol used by Wi-Fi Protected Access 3 (WPA3-Personal) to establish encrypted communication between a wireless client and a Wi-Fi access point. Unlike earlier WPA2 authentication methods based on a pre-shared key (PSK), SAE provides mutual authentication while significantly improving resistance to password-guessing attacks and other security vulnerabilities.

The basic principle is straightforward. Both the wireless client and the access point begin with the same password but do not transmit the password itself across the wireless link. Instead, they perform a cryptographic exchange that allows each side to prove knowledge of the password while establishing a unique session key. If authentication is successful, secure encrypted communication begins using keys generated specifically for that connection.

A useful analogy is two people proving they know the same secret handshake without ever saying the secret aloud. By successfully completing the handshake, each person confirms the other's identity while keeping the shared secret hidden from anyone watching. SAE performs a similar function using modern cryptographic techniques.

One of the principal advantages of SAE is its resistance to offline dictionary attacks. In WPA2-Personal, an attacker who captured the authentication handshake could repeatedly test password guesses offline until the correct password was found. SAE prevents this by requiring active participation in each authentication attempt, making large-scale automated password guessing far more difficult. Each incorrect password guess requires a complete interaction with the access point, significantly increasing the time and effort required for an attack.

SAE also provides forward secrecy. Each connection generates fresh cryptographic session keys that are independent of previous sessions. Consequently, even if the network password is discovered at a later date, previously captured encrypted traffic cannot normally be decrypted because the temporary session keys are no longer available.

SAE is based on the Dragonfly Key Exchange protocol and forms the authentication mechanism used by WPA3-Personal. It is supported by modern Wi-Fi access points, smartphones, laptops, tablets, and other wireless devices certified for WPA3 operation. Many devices also support a transition mode that allows WPA2 and WPA3 clients to coexist while networks migrate to the newer standard.

It is important to distinguish Simultaneous Authentication of Equals from the Pre-Shared Key (PSK) authentication used by WPA2. Both use a shared password, but WPA2 derives encryption keys directly from the password after the four-way handshake, whereas SAE performs a secure password-authenticated key exchange that generates fresh session keys while providing substantially stronger protection against password attacks and key-management vulnerabilities.

Today, Simultaneous Authentication of Equals represents one of the most important security improvements introduced by WPA3. By replacing the older WPA2 authentication mechanism with a more robust cryptographic protocol, SAE significantly strengthens the security of wireless local area networks and provides better protection against many of the attacks that have emerged as Wi-Fi usage has become increasingly widespread.