WEP (Wired Equivalent Privacy) – Clean Notes

Why WEP Exists

Open wireless networks transmit data without encryption, making them vulnerable to eavesdropping.

To address this, WEP was introduced in 1997 as part of the IEEE 802.11 standard, aiming to provide “wired-equivalent” privacy for Wi-Fi traffic.

Although WEP has been replaced by WPA / WPA2, it may still appear in legacy or business environments, making it relevant for security research and wireless pentesting.

Core Components of WEP

WEP relies on the following cryptographic elements:

• RC4 stream cipher
• Shared secret key
  • 40-bit (WEP-64)
  • 104-bit (WEP-128)
• Initialization Vector (IV) – 24 bits
• CRC32 for integrity checking

The IV is prepended to the secret key and passed to RC4 to generate the keystream.

Critical Design Weakness

Even after export restrictions were lifted and 128-bit keys were introduced, WEP kept the same 24-bit IV.

This causes:

• IV exhaustion after ~16 million packets
• IV reuse