A municipal utilities yard is moving IoT gateways to WPA3-Personal. A technician claims SAE is “the encryption cipher that scrambles every data frame.” How should the security designer correct that statement?
Select an answer to reveal the explanation.
Short Explanation
SAE is the handshake that proves you know the yard’s Wi-Fi password without handing crackers an easy offline win—it is not the paint that covers every data frame. After authentication, CCMP or GCMP still do the confidentiality work. Mixing those layers up leads to bad design choices.
Full Explanation
On a municipal utilities yard moving IoT gateways to WPA3-Personal, Simultaneous Authentication of Equals (SAE) is the password-based authentication and key-management method. SAE proves passphrase knowledge with stronger resistance to offline dictionary attacks than classic PSK AKM and contributes keying material for later session keys, but it is not the protocol that encrypts each MSDU on the air. After successful SAE, data confidentiality still relies on modern pairwise protocols such as CCMP or GCMP using AES for the yard’s telemetry and control paths. Agreeing that SAE replaces AES as the pairwise data cipher collapses AKM and confidentiality into one incorrect layer and leads to designs that omit cipher-suite policy entirely. Claiming SAE applies only to wired 802.1X switch ports erases its primary WLAN Personal-mode role for password-based networks. Treating SAE as captive-portal branding denies its real cryptographic AKM function and invites portal-only “security” thinking that leaves RF frames unprotected. Exam caveat: WPA3-Personal marketing often says “SAE encryption,” but CWSP-level answers must keep authentication/AKM distinct from CCMP/GCMP data protection when evaluating vendor claims for IoT SSIDs. Operational check: after converting a test gateway SSID to WPA3-Personal, confirm the AKM suite shows SAE while the pairwise cipher shows CCMP or GCMP in the association record—not “SAE” listed as the data cipher alone—before expanding to production gateways.