With the theoretical strengths of SAE and OWE established, the reality of deployment introduces 'Transition Mode.' Since not all devices support WPA3, this mode allows WPA2 and WPA3 clients to connect to the same SSID.
In Transition Mode, the Access Point broadcasts that it supports both WPA2-PSK and WPA3-SAE. A WPA3-capable client will choose SAE, while a legacy client will fall back to the 4-way handshake.
💡 Protected Management Frames (PMF) are required for WPA3 but optional for WPA2. In transition mode, PMF is set to 'Capable' (Optional).
The 'WPA2-PSK+WPA3-SAE' tag indicates the AP is in Transition Mode, allowing mixed-client environments.
Transition mode introduces a critical vulnerability: Downgrade Attacks. An attacker can spoof the AP to appear as WPA2-only, forcing a WPA3-capable client to use the weaker handshake.
# Simulating a Downgrade Attack (Conceptual)
# 1. Spoof BSSID of target AP
# 2. Broadcast Beacons with WPA2-only flags
# 3. Force client to disconnect from real AP
# 4. Client reconnects to fake AP using WPA2-PSK
# 5. Capture handshake for offline cracking| Mode | WPA2 Client | WPA3 Client | Security Level |
|---|---|---|---|
| WPA2-Only | Connects | Connects (as WPA2) | Low (Vulnerable) |
| WPA3-Only | Cannot Connect | Connects | High (Secure) |
| Transition | Connects (WPA2) | Connects (WPA3) | Medium (Downgrade Risk) |
To eliminate downgrade risks, administrators should move to 'WPA3-Only' mode as soon as their device fleet is updated. If transition mode is required, monitoring for deauthentication floods is critical.
Transition mode is a convenience feature, not a security feature. It is a compromise that preserves the weaknesses of WPA2.
Verify exercises to earn ★ 180 XP and unlock next lab level.