Wired Equivalent Privacy (WEP)

How WEP worked

WEP uses the RC4 stream cipher to combine a secret key with a per‑packet initialization vector (IV). The IV is 24 bits long and is transmitted in the clear with each frame. For integrity checking WEP relied on a simple CRC‑32 checksum rather than a cryptographic message authentication code. Typical implementations exposed keys of two nominal lengths; vendors referred to these as 64‑bit (often called WEP‑40) and 128‑bit (often called WEP‑104) variants, which include the IV in the advertised bit length.

Vulnerabilities and attacks

Researchers demonstrated practical attacks on WEP in the early 2000s. Weaknesses arise from the small IV space, predictable IV usage in some devices, and exploitable properties of the RC4 key scheduling algorithm, which permit key recovery from captured traffic. The linear CRC integrity check also allows attackers to modify packets without detection. These flaws enable both passive eavesdropping and active forgery or replay attacks, and they can be exploited with readily available tools to recover keys within minutes in many environments. For background on cryptanalysis and published work, see the early research by researchers.

History and replacement

Because of these shortcomings the IEEE formed a working group to revise 802.11 security. Industry and standards bodies moved to stronger designs: Wi‑Fi Protected Access (WPA) was introduced as an interim successor and later the full 802.11i amendment produced WPA2, which uses stronger algorithms such as AES and a proper message integrity mechanism. The Wi‑Fi Alliance published migration guidance and deprecated WEP; most vendors and the IEEE recommend disabling WEP in favor of WPA2 or WPA3. See the Wi‑Fi Alliance announcement about WPA for more context at WPA.

Practical implications and mitigation

• WEP is considered insecure and should not be used to protect sensitive data.
• Legacy devices that only support WEP should be updated, replaced, or isolated on a separate network segment.
• If a network must operate with older hardware, use additional protections such as VPNs or application‑level encryption to protect data in transit.
• Modern wireless equipment and configuration utilities still sometimes present WEP as an option; administrators should choose more secure modes instead. Manufacturer configuration pages are often the place this choice appears — for example in many router interfaces.

Notable distinctions and facts

Despite being obsolete from a security standpoint, WEP remains widely recognized because it was the default mechanism in early consumer Wi‑Fi products. Its design illustrates common pitfalls in cryptographic protocol design: small IV entropy, reuse of keystream material, and reliance on non‑cryptographic integrity checks. For general information about wireless networking and encryption concepts see resources on Wireless LANs and on encryption. Tools that can crack WEP are documented in many places; their availability underscores why WEP no longer provides meaningful protection — examples and tutorials can be found at various security sites (see cracking tools and demonstrations).

In short, WEP played an important historical role in early Wi‑Fi adoption but is now a deprecated technology. Administrators and users should use WPA2 or WPA3 with strong passphrases and modern ciphers to secure wireless networks.