Why is shared key authentication considered a security risk in a WLAN?

• A. The challenge is transmitted in the clear, but is not used.
• B. The access point transmits the challenge text in the clear and the same text is encrypted with the WEP key.
• C. WEP provides strong encryption for the shared key.
• D. Credentials are never exchanged during authentication.

Answer: (B)

The key idea is that shared key authentication relies on a challenge–response that exposes the challenge in the clear. The access point sends a random challenge as plaintext, and the client replies by encrypting that same challenge with the pre-shared key. An eavesdropper who captures the plaintext challenge and the encrypted response can test guesses for the pre-shared key offline: if a candidate key, when used to encrypt the challenge, produces the observed ciphertext, that candidate is verified. With a weak pre-shared key, this offline guessing becomes practical, enabling someone to recover the key without directly breaking the encryption on all traffic. That’s why this authentication method is considered a security risk in a WLAN.