WPA3 SAE Dragonfly Key Exchange Explained
The security team of Debry Inc. decided to upgrade Wi-Fi security to thwart attacks such as dictionary attacks and key recovery attacks. For this purpose, the security team started implementing cutting-edge technology that uses a modern key establishment protocol called the simultaneous authentication of equals (SAE), also known as dragonfly key exchange, which replaces the PSK concept. What is the Wi-Fi encryption technology implemented by Debry Inc.?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests recognition of the SAE/Dragonfly handshake as the defining feature of WPA3; the trap is picking WPA2, since most learners associate Wi-Fi hardening with the AES-CCMP upgrade WPA2 already provides.
Debry Inc. is deploying WPA3, the Wi-Fi standard that replaces the pre-shared key (PSK) handshake with the Simultaneous Authentication of Equals (SAE) or Dragonfly key exchange. The page establishes that SAE's forward secrecy andCommitment-based handshake are what make WPA3 resistant to offline dictionary and key-recovery attacks that defeat WPA/WPA2.
No learner votes for it, but the most plausible distractor is D (WPA2), because WPA2 already introduced AES encryption and is the most widely deployed standard — yet WPA2-PSK still relies on the four-way 4-Way Handshake over a PBKDF2-derived PSK, which remains vulnerable to offline dictionary and KRACK-style attacks.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
WPA3 is the only standard listed that uses Simultaneous Authentication of Equals (SAE), the Dragonfly key exchange, in place of the legacy PSK-derived session keys. SAE is a password-authenticated key exchange (PAKE) that negotiates a fresh session key through an exchange of commit and confirm messages using elliptic-curve cryptography, so an eavesdropper capturing the full handshake gains no usable password material for an offline dictionary attack. This directly addresses the threat model named in the question — dictionary attacks and key recovery attacks — and WPA3 additionally mandates 192-bit and 256-bit GCMP-256 cryptographic suites, as the CEH Module 16 text notes. The question explicitly states the technology "replaces the PSK concept," which only WPA3 does.Why the Other Options Are Wrong
WEP (B) is a broken RC4-based scheme with 24-bit IVs and CRC-32 integrity, fully defeated by tools like aircrack-ng within minutes — it has no SAE and no modern key establishment at all. WPA (A) was only an interim TKIP patch over RC4, retained for backward compatibility with WEP-era hardware, and still authenticates with a static PSK via the same handshake vulnerable to dictionary capture. WPA2 (D) is the most tempting wrong choice because it introduced AES-CCMP, but its Pre-Shared Key mode derives keys from the passphrase with PBKDF2 and authenticates through the 4-Way Handshake, so a captured EAPOL exchange can still be brute-forced offline; it has no SAE/Dragonfly. Only WPA3 replaces that model.Community Comment Notes
The community is unanimous on C, and the reasoning cited is sound: insaniunt points out that "also known as dragonfly key exchange = wpa3", and ethacker2 quotes CEH v12 Module 16 p.2392, describing WPA3 as "resistant to offline dictionary attacks and key recovery attacks" through SAE. LordXander echoes the same identification. qtygbapjpesdayazko's request for professional verification is worth honoring: the vendor-cited module text and the Wi-Fi Alliance WPA3 specification both confirm SAE is the WPA3-Personal authentication mechanism, so the consensus is correct here.Official Reference
Exam Strategy
On CEH wireless questions, treat keyword-to-standard matching as decisive: SAE, Dragonfly, GCMP-256, and Forward Secrecy all point to WPA3, while TKIP points to WPA and CCMP-AES points to WPA2. Read which mechanism the scenario says is being replaced — if the PSK handshake itself is replaced, the answer is WPA3, not an incremental hardening of WPA2.
Frequently Asked Questions
Why doesn't WPA2 with AES stop the dictionary attacks mentioned in this question?
AES-CCMP protects the data in transit but does not prevent offline guessing of a weak pre-shared key; SAE's Dragonfly exchange fixes this by revealing no password-derived value an attacker can reuse.
What makes SAE/Dragonfly resistant to key recovery when WPA2's handshake is not?
SAE is a password-authenticated key exchange using elliptic-curve commit and confirm messages, providing forward secrecy — capturing the full exchange yields nothing usable for offline recovery of the password or session key.