Using a shared initial key is dangerous in ________.

• A. WEP
• B. WPA pre-shared key mode
• C. Both A and B
• D. Neither A nor B

Answer: (A)

The main idea is that using a single shared key with WEP creates a vulnerability tied to how the encryption is built. WEP relies on the RC4 stream cipher and prepends every frame with a 24-bit Initialization Vector (IV) that is sent in the clear. All devices share the same secret key, and the IV is used to seed the keystream. Because there are only 2^24 possible IVs, the IV values inevitably repeat as more traffic is captured. When the same keystream is used for multiple packets, an attacker can XOR ciphertexts together to cancel out the keystream and reveal relationships between the corresponding plaintexts, often enabling recovery of the plaintext or the key material with enough data and some known-plaintext information. This combination of a single, shared key and a very small, publicly visible IV makes WEP highly vulnerable to passive and active attacks, allowing someone to decrypt traffic and even inject packets.

WPA in PSK mode uses a different approach. It still involves a shared secret, but the four-way handshake derives per-session keys from that secret, and modern encryption (TKIP or CCMP) ensures that keystream is not reused across packets and that data integrity is protected. The shared key itself isn’t enough to immediately reveal all traffic, provided the passphrase isn’t weak. So the inherent danger of a single shared key is most pronounced in WEP’s design, which is why that scenario is highlighted.