The city wants downtown kiosk Wi-Fi to remain passphrase-free for tourists yet still encrypt each device’s unicast frames. Which AKM should the design select for that open SSID goal?
Select an answer to reveal the explanation.
Short Explanation
Tourists won’t type a 63-character PSK next to the fountain. OWE keeps the SSID “open” for joining while still giving each device encrypted unicast—password-free without going full postcard-clear.
Full Explanation
Downtown kiosk Wi-Fi that must remain passphrase-free for tourists while still encrypting each device’s unicast frames should use OWE AKM. Opportunistic Wireless Encryption is purpose-built for open joining without a shared passphrase while still performing a key exchange that protects unicast traffic from casual passive sniffing around fountains and transit plazas. That matches tourism and kiosk goals better than pretending every visitor will type a long PSK. WPA2-Personal with the passphrase printed on every lamppost recreates a public shared secret and invites abuse. Static WEP shared-key mode labeled “municipal open” is deprecated cryptography with misleading branding. WPA3-Enterprise 192-bit with smart-card EAP-TLS for every tourist phone is operationally unrealistic for transient public users and misapplies a high-assurance staff suite to a kiosk audience. Exam caveat: OWE is not authorization into city internal systems; pair public OWE SSIDs with segmentation and filtering so tourists cannot reach staff VLANs. Operational check: associate a personal phone to the kiosk OWE SSID with no password, confirm unicast encryption in a capture, and verify ACL or firewall policy still blocks paths into municipal internal subnets.