said by jbibe
:said by Jason Cohen
:1) Is WPA/WPA2-Enterprise inherently more secure than WPA/WPA2-PSK?
In most cases the answer is yes, the Enterprise mode is more secure than the PSK mode. Most access points use a single PSK when operating in the WPA-PSK or WPA2-PSK modes. Although the specification (802.11i) allows the use of multiple PSKs, most access points do not provide this feature. This means that cases where PSK is in use there is a single PMK, since the PMK=PSK.
In the Enterprise mode, every station has a different PMK. During authentication, the RADIUS server produces a new Master Key (MK). The RADIUS server transfers the MK to the station. The RADIUS server and station then derive the PMK. Beyond producing a new PMK with during the initial connection, many access points require re-authentication at regular intervals, perhaps every 30 minutes. Each re-authentication produces a new PMK.
What security risk is entailed by having a single PMK? I would think that the biggest risk of PSK mode is that any client on the wireless network can decrypt the traffic from any other client.