802.11i
An IEEE standard specifying security mechanisms for 802.11 networks. 802.11i makes use of the Advanced Encryption Standard (AES) block cipher. The standard also includes improvements in key management, user authentication through 802.1X and data integrity of headers.
802.11i: the WiFi security standard that actually works
802.11i is the IEEE wireless LAN security standard ratified in 2004 that replaced the fatally flawed WEP (Wired Equivalent Privacy) encryption. It defines how to encrypt and authenticate traffic over 802.11 wireless networks using either the Temporal Key Integrity Protocol (TKIP) as a transitional measure or the stronger Wi-Fi Protected Access 2 (WPA2) framework built on AES-CCMP encryption. The standard also mandates 802.1X port-based network access control for user authentication and includes message integrity checking to prevent tampering with packet headers.
The core encryption engine in 802.11i uses AES in Counter with CBC-MAC mode (CCMP), which encrypts the frame body and computes a 64-bit or 128-bit authentication tag. This replaces WEP's broken RC4 stream cipher, which was vulnerable to statistical attacks that could recover keys in minutes. TKIP, included for backward compatibility with older hardware, wraps RC4 with per-packet key mixing and message integrity codes, but it remains fundamentally weaker than AES and is now deprecated in the WiFi 6 standard.
Key Management and Authentication
802.11i separates authentication of the user from encryption key distribution. The standard uses 802.1X, which relies on the Extensible Authentication Protocol (EAP) to validate credentials against a backend authentication server before granting access to the network. This is typically RADIUS in enterprise deployments. For small networks without a dedicated authentication server, Pre-Shared Key (PSK) mode allows a single passphrase to derive encryption keys, though this offers weaker security guarantees than 802.1X enterprise mode.
The four-way handshake defined in 802.11i establishes the Pairwise Transient Key (PTK) between the client and access point after successful authentication. A separate Group Transient Key (GTK) secures multicast and broadcast frames. These keys are generated from the master key material and are updated periodically or when clients disconnect, preventing an attacker with a single captured passphrase from decrypting all historical traffic.
Deployment of 802.11i remains inconsistent. Enterprise networks typically enforce WPA2 with 802.1X, achieving strong cryptographic security. Consumer and small-business networks often use WPA2-PSK, which is resistant to passive eavesdropping but vulnerable to brute-force attacks on weak passphrases. The emergence of WPA3 in 2018 introduced Simultaneous Authentication of Equals (SAE) to replace the PSK handshake, but 802.11i hardware remains the dominant installed base in industrial and IoT environments where wireless networks must coexist with legacy equipment.