Its known that all wifi encryption methods to secure your network from attackers are broken, WEP, WPA, WPA2... With some amount of time someone can break in in your network.

Why we can't use some kind of public key cryptography, (For example, SSL (used in https) allows to connect using a encrypted and authenticated channel to a server) to connect to our home router?

I mean, instead of using WPA the router could start a SSL like connection (with a self signed certificate) to a client, when the handshake is done the client can provide a password, if the password is correct the router trust the client as a valid client (not an attacker).

This way no one can get inside a network without knowing the password and the clients of a network cannot sniff eachother or perform a MITM attack.

Also, to limit bruteforce the router can ask for a proof of work for each password attempt.

In summary: Computer wants to connect to a Wifi network, it contacts to the router to stablish a secure encrypted channel, then the computer provides a password to the router, if the router validates it adds the computer's public key to a whitelist (that computer is trusted and cann access the internet and the network).

I dont know if this is even possible and I might be wrong in some things, please answer if this can be done (by router manufacturers) or if it is planned to be done (or similar systems to be the future of current methods).


  • 1
    Sure, WPA/WPA2 can do that; it's commonly called "WPA-Enterprise". I think corporate Ethernet often uses the same 802.1X as well. Also, WPA2 is secure – only WEP & WPA (TKIP) are broken. Mar 29, 2014 at 17:14
  • @grawity Yes, but WPA-Enterprise is not meant to be used by normal users (I believe). There is something being developed to replace as the default of security in wifi?
    – user37505
    Mar 29, 2014 at 17:53

1 Answer 1


You've almost exactly described WPA2-Enterprise, with PEAP or TTLS. There's nothing keeping consumers from using it, except for the fact that consumers don't understand certificates.

Well that, and the fact that most AP vendors don't build a full Authenticator into their AP firmware, and instead rely on an external RADIUS server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .