A municipal library wants an open guest SSID that still encrypts each patron’s unicast traffic without distributing a passphrase. Which exchange enables that opportunistic encryption?
Select an answer to reveal the explanation.
Short Explanation
Open Wi-Fi used to be postcard-in-the-clear. OWE is the polite upgrade: no password on the chalkboard, but each client still does a Diffie-Hellman-style dance so eavesdroppers don’t read your ebook checkout. Captive portals don’t magically encrypt 802.11 unicast.
Full Explanation
A municipal library that wants an open guest SSID while still encrypting each patron’s unicast traffic without distributing a passphrase should rely on an OWE Diffie-Hellman–style exchange. OWE keeps joining password-free for visitors yet establishes per-client encryption so casual eavesdroppers cannot trivially read unicast frames on the reading-room air. That is the correct opportunistic encryption path when leadership refuses a shared guest PSK but still wants RF confidentiality. A captive-portal HTTP redirect alone does not encrypt Layer 2 frames after the splash page; portals gate terms or sessions, they do not replace OWE or an RSN cipher suite. Static WEP shared-key authentication advertised as “open with privacy” revives a broken cipher under misleading branding. WPA2-Personal with the passphrase posted on the library wall recreates a public shared secret and invites offline attacks against that PSK community. Exam caveat: OWE protects opportunistic unicast confidentiality on open networks; it does not authenticate patrons to library staff systems or replace content-filtering policy decisions. Operational check: enable OWE on a library pilot SSID, associate a modern patron device without entering a password, and verify in a protocol capture that unicast data frames are encrypted while association remained passphrase-free.