The Wired Equivalent Privacy (WEP) standard was the first security standard to be developed in conjunction with the 802.11 standards. First deployed in 1999 alongside the first widely adopted iteration of 802.11, WEP was designed to provide the same amount of security that was found on wired networks. This was accomplished using a combination of RC4 ciphers to provide confidentiality and the use of the CRC32 for integrity.

Authenticating to a WEP network is done through the use of either a 64- or 128-bit key. The 64-bit key is derived by entering a series of 10 hexadecimal characters. These initial 40 bits are combined with a 24-bit Initialization Vector (IV), which forms the RC4 encryption key. For the 128-bit key, a 104-bit key or 26 hexadecimal characters are combined with the 24-bit IV to create the RC4 key.

Authenticating to a WEP wireless network is a four-stage process:

1. The client sends a request to the WEP access point to authenticate.
2. The WEP access point sends a cleartext message to the client.
3. The client takes the entered WEP key and encrypts the cleartext message that the access point transmitted. The client sends this on to the access point.
4. The access point decrypts the message sent by the client with its own WEP key. If the message is decrypted properly, the client is allowed to connect.

As was addressed previously, WEP was not designed with message confidentiality and integrity as a central focus. As a result, there are two key vulnerabilities with WEP implementations. First, the CRC32 algorithm is not used for encryption per se, but rather as a checksum against errors. The second is that the RC4 is susceptible to what is known as an Initialization Vector attack. The IV attack is possible due to the fact that the RC4 cipher is a stream cipher and, as a result, the same key should never be used twice. The 24-bit key is too short on a busy wireless network to be of use. In about 50% of cases, the same IV will be used in a wireless communication channel within 5,000 uses. This will cause a collision, whereby the IV and the entire WEP key can be reversed.

Due to the security vulnerabilities, WEP began to be phased out in 2003 in favor of more secure wireless implementations. As a result, there is a good chance that you may not see one implemented in the wild, but there are access points sold on the commercial market to this day that still have WEP enabled. Also, you may encounter legacy networks that still use this protocol.