---
title: "Short note: WEP"
subject: "Computer Networks and Security"
chapter: 8
key: "semester_7/computer_networks_and_security:wep-note"
source: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/wep-note
site: BCT Engineering
---

# Short note: WEP

Computer Networks and Security · Chapter 8: Network Security

- Asked in: 2071 Shrawan, 4 marks; 2071 Chaitra, 4 marks (asked 2 times)
- Video: [Wired Equivalent Privacy (WEP) Explained](https://www.youtube.com/watch?v=6cKgoA3Qj60) — Ahmed Ibrahim
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/wep-note
- Whole chapter: https://www.bctengineer.com/md/semester_7/computer_networks_and_security/chapter-8

## Question

Write a short note on WEP.

## Short answer

WEP is the original 802.11 security scheme using RC4 with a 40/104-bit key plus 24-bit IV and CRC-32 integrity. Weaknesses include IV reuse, FMS key recovery, linear CRC, and no replay protection. It is obsolete, replaced by WPA/WPA2/WPA3.

## Answer

**WEP (Wired Equivalent Privacy)** is the original security algorithm of the IEEE 802.11 Wi-Fi standard (1997). It was meant to give a wireless LAN the same level of confidentiality as a wired LAN.

#### Operation
- Uses the **RC4 stream cipher** with a shared secret key of 40 or 104 bits.
- A 24-bit **initialisation vector (IV)** is added to the key (total 64 or 128 bits) to form the RC4 seed, and the IV is sent in plain text in each frame.
- Integrity: a 32-bit **CRC-32** (Integrity Check Value) is appended to the data before encryption.
- Encryption: ciphertext = (data + ICV) XOR RC4 keystream.
- Authentication: open system or shared key (challenge-response).

```text
IV + Key -> RC4 -> keystream
Data+CRC  XOR keystream -> [IV | Ciphertext]
```

#### Weaknesses
1. The IV is only 24 bits (2²⁴ = 16.7 million values), so it repeats quickly (after a few thousand packets by chance), and reused keystreams reveal the plaintext.
2. FMS and other attacks recover the key from captured packets within minutes.
3. CRC-32 is linear, so an attacker can modify messages without detection.
4. No replay protection; no per-user keys; shared key authentication leaks keystream.

WEP is obsolete and was replaced by **WPA** (TKIP) and **WPA2/WPA3** (AES-CCMP).

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Which cipher does WEP use?
   A. DES
   B. RSA
   C. AES
   D. RC4 stream cipher
   Answer: D. WEP uses RC4 with a 40 or 104-bit key plus 24-bit IV. (Key point: Cipher)

2. Why is the 24-bit IV a weakness?
   A. It is too long
   B. It repeats quickly (only 2^24 values), so keystreams are reused
   C. It is secret
   D. It is encrypted
   Answer: B. Reused keystreams reveal plaintext. (Key point: IV weakness)

3. Why is CRC-32 unsuitable for integrity in WEP?
   A. It is 128 bits
   B. It is linear, so messages can be modified undetected
   C. It is encrypted twice
   D. It is too slow
   Answer: B. Attackers can alter data and fix the CRC. (Key point: CRC)

4. What replaced WEP?
   A. IPsec
   B. PGP
   C. WPA, WPA2/WPA3
   D. SSL
   Answer: C. WPA uses TKIP; WPA2/WPA3 use AES-CCMP. (Key point: Replacement)